CVE-2026-72743 is a stored XSS in SQLBot's dashboard widget rendering, using Vue's v-html directive with TinyMCE output — but the CVSS 5.4 rating obscures more than it reveals. The score applies a standard webapp trust model to a database administration tool where the 'attacker' already has dashboard-write permissions. If an attacker can modify dashboard widgets, they almost certainly have direct database access, making this XSS less a privilege escalation vector and more a session-hijacking concern for other admins viewing the poisoned interface.
The more important question is not the CVSS denominator but what stopped this at code review. Vue's v-html carries explicit documentation warnings, and TinyMCE produces structured output that often doesn't require v-html at all. This reads as a workflow failure — a developer reaching for the quickest rendering path under time pressure, with no tooling friction (no security-focused linter flagging v-html with unsanitized sources) to redirect them toward DOMPurify or sanitize-html. The fix in commit c3f40a5 reportedly addressed the issue, but you should verify whether it implements genuine HTML sanitization or simply removed the rendering path entirely — the latter creates technical debt that will surface when legitimate TinyMCE users complain about broken rendering.
The structural pattern here is concerning: Vue provides no first-party sanitization path, systematically pushing developers toward the dangerous shortcut. This exact mutation (Vue + TinyMCE + v-html stored XSS) has appeared before and will appear again unless Vue addresses the framework-level pressure. Track whether your SQLBot instance has security linting configured to catch v-html usage.
Finally, the CVSS medium rating carries organizational consequences. It creates permission to deprioritize, normalizes operating with known risk, and sets the stage for institutional forgetting. The removed rendering path will be rediscovered in three to five years by a new team who restore it with a commit message like 'restore dashboard functionality' — the threat model behind its removal having decayed from institutional memory. Your compensating controls will decay faster than the vulnerability will be re reintroduced. Document this vulnerability's removal rationale in architecture decision records, not just the commit history.