Summary
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Resource Summary functionality.
A user with a lower-privileged role that is authorized to create or edit resources can inject arbitrary HTML/JavaScript into the Summary field. The application stores the supplied value server-side without properly sanitizing or encoding it before rendering it to other users.
When a higher-privileged user opens the affected resource and accesses the resource editing interface, the stored payload is rendered and executed in the victim's browser under the application's origin.
Because the attacker-controlled content persists server-side and is subsequently executed in the context of another user's authenticated session, this vulnerability crosses the intended privilege boundary between users with different roles.