External risk intelligence

Countly Server Star Rating Plugin Stores Attacker Content for Session Token Exposure.

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-44977

Countly-server is a product analytics solution, which is commonly deployed as an internet-facing web application to collect telemetry from public-facing websites or applications. Because it functions as an externally reachable web-based platform for data collection and administrative management, it presents a commonly exposed surface in typical deployment scenarios.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in Countly-server, a product analytics solution, which could allow an attacker to execute malicious content within the application's origin. While requiring specific conditions, successful exploitation could expose sensitive session information, potentially impacting data integrity and confidentiality.

Stored content execution via product analytics platform.
Potential exposure of session tokens and sensitive data.
Confirm relevance and exposure of analytics tool.

Attack Path

How an attacker could exploit the issue

An attacker with administrator privileges can upload a file containing active content, which is then stored and served by the server. When a global administrator views this stored content, the malicious payload executes within the Countly origin, potentially exposing sensitive session tokens.

Non-global admin uploads malicious file.
Global admin views feedback preview.
Session tokens exposed to attacker.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a non-global administrator could store malicious active content within the application. A global administrator opening a preview of this content could then execute code within the Countly origin, potentially exposing sensitive session tokens.

Stored active content.
Malicious file upload and preview.
Session token exposure to attacker.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this vulnerability in Countly-server, particularly those managing web-facing analytics solutions. The initial step is to locate all instances of Countly-server, confirm their exposure, and identify the business-criticality and accountable owners. Subsequently, a risk-based remediation plan, potentially involving vendor coordination or updates, should be formulated and executed.

Accountable application or infrastructure owners.
Verify Countly-server instances and exposure.
Plan and coordinate updates or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Countly-server?

Countly-server is the backend component of Countly, a platform used to track and analyze user behavior across websites and mobile applications. It functions as a centralized hub for ingesting telemetry data, managing analytics dashboards, and configuring plugin-based features like star ratings.

Why is CVE-2026-44977 classified as CWE-79?

This CVE falls under CWE-79, also known as Cross-Site Scripting (XSS). The vulnerability exists because the star-rating plugin accepts and serves files while trusting the user-provided MIME type. By failing to validate the file content, the server allows malicious scripts to be stored and subsequently executed within the browser of a victim who views the feedback.

How is the malicious payload triggered?

An attacker needs two specific actions to trigger the bug. First, a non-global administrator must upload a file containing active content. Second, a global administrator must open the feedback preview in their browser. Simply uploading the file is insufficient; the malicious code only executes when the global administrator views it, allowing the script to run within the Countly origin.

Is my deployment at risk?

Halo Surface Signal indicates that Countly-server is frequently deployed as an internet-facing application to collect public telemetry, which increases its accessibility to potential attackers. If your instance is reachable over the internet, it presents a more accessible surface for this type of administrative-level abuse compared to an internal, isolated deployment.

Do I need to update my software?

Yes, you should prioritize updating your instances to versions 24.05.50 or 25.03.44. As a first step, verify all running instances of Countly-server in your environment to understand your current footprint. Once identified, work with your infrastructure or application owners to schedule the update, as this is the primary method to resolve the underlying storage and execution flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.