Live › vulnerability › CVE-2026-58205
Go to dashboardGRR, a resource management and reservation application, reflects the forcemaj parameter in maj.php without escaping while installation files remain on the server. An attacker who gets a victim to open a crafted URL runs JavaScript in the victim's browser, and because the authentication cookie lacks HttpOnly, can steal the session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 23:29 UTC. All times on this page are UTC.
Teams running self-hosted GRR before version 4.5.0 where the installation files, including maj.php, remain reachable on the web server. Instances with the installation files removed are not exposed through this path. Sources do not say whether managed hosting exists.
No product ranges from the sources yet.
maj.php or the installation directory still exists on the GRR web root (unknown exact path in sources)4.5.04.5.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
GRR is a resource management and reservation application. Prior to version 4.5.0, maj.php reflects the forcemaj parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim's browser when the victim accesses it. This reflected cross-site scripting can enable phishing, redirection to malicious sites, cookie theft and session hijacking because the authentication cookie is not HttpOnly. This issue is fixed in version 4.5.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-58205")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.