GHSA-xhf6-8p48-3pxq: Stored XSS in openEQUELLA

Before openEQUELLA 2026.2, the pre-login notice is stored as HTML and rendered on the legacy login page without encoding or sanitisation. A user with the EDIT_SYSTEM_SETTINGS permission can set a notice containing an arbitrary script, resulting in stored cross-site scripting (XSS) on the login page. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or Everyone.