{"id":"CVE-2026-58205","kind":"vulnerability","aliases":["CVE-2026-58205"],"related":[],"title":"GRR resource reservation app: reflected XSS via maj.php forcemaj parameter","description":"GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim's browser when the victim accesses it. This reflected cross-site scripting can enable phishing, redirection to malicious sites, cookie theft and session hijacking because the authentication cookie is not `HttpOnly`. This issue is fixed in version 4.5.0.","summary":"GRR, a resource management and reservation application, reflects the forcemaj parameter in maj.php without escaping while installation files remain on the server. An attacker who gets a victim to open a crafted URL runs JavaScript in the victim's browser, and because the authentication cookie lacks HttpOnly, can steal the session.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["grr","package","php","self-hosted"],"not_affected_if":["installation-files-removed"],"how_to_check":"- Check whether `maj.php` or the installation directory still exists on the GRR web root (unknown exact path in sources)\n- Check the installed GRR version; affected versions are those before `4.5.0`","fix":"- Upgrade GRR to `4.5.0` or later\n- Remove the installation files after installing or upgrading, since removal is not automatic","status":"open","published_at":"2026-10-27T23:17:05+00:00","first_seen_at":"2026-10-27T23:29:44+00:00","triaged_at":"2026-10-27T23:31:14+00:00","updated_at":"2026-10-27T23:31:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T23:31:14Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GRR to `4.5.0` or later\n- Remove the installation files after installing or upgrading, since removal is not automatic","reach":"internet","title":"GRR resource reservation app: reflected XSS via maj.php forcemaj parameter","impact":"medium","summary":"GRR, a resource management and reservation application, reflects the forcemaj parameter in maj.php without escaping while installation files remain on the server. An attacker who gets a victim to open a crafted URL runs JavaScript in the victim's browser, and because the authentication cookie lacks HttpOnly, can steal the session.","category":"package","nicknames":[],"who_cares":["grr","self-hosted","php"],"confidence":0.6,"needs_auth":"no","worst_case":"Victim session hijacked via attacker-run JavaScript in browser","analyst_note":"","how_to_check":"- Check whether `maj.php` or the installation directory still exists on the GRR web root (unknown exact path in sources)\n- Check the installed GRR version; affected versions are those before `4.5.0`","needs_analyst":false,"not_affected_if":["installation-files-removed"],"who_is_affected":"Teams running self-hosted GRR before version 4.5.0 where the installation files, including maj.php, remain reachable on the web server. Instances with the installation files removed are not exposed through this path. Sources do not say whether managed hosting exists.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000597,"input_tokens":3380,"output_tokens":519,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-58205':13A,16A '4.5.0':85C,157C 'access':98C,124C 'adequ':92C 'app':4A 'applic':29B,81C 'arbitrari':114C 'attack':46B,107C 'authent':66B,146C 'automat':105C 'browser':62B,120C 'cooki':67B,139C,147C 'craft':54B,109C 'cross':129C 'cross-sit':128C 'cve':11A,14A 'enabl':133C 'escap':37B,93C 'execut':113C 'file':40B,96C,102C 'fix':154C 'forcemaj':9A,32B,89C 'get':48B 'grr':1A,17B,23B,74C 'hijack':143C 'host':22B 'httpon':69B,150C 'instal':39B,95C 'issu':152C 'javascript':57B,115C 'lack':68B 'maj.php':8A,35B,86C 'malici':137C 'manag':26B,78C 'open':52B 'packag':18B 'paramet':10A,33B,90C 'phish':134C 'php':19B 'prior':82C 'redirect':135C 'reflect':5A,30B,87C,127C 'remain':41B,97C 'remov':99C 'reserv':3A,28B,80C 'resourc':2A,25B,77C 'run':56B 'script':131C 'self':21B 'self-host':20B 'server':44B 'session':73B,142C 'site':130C,138C 'steal':71B 'theft':140C 'url':55B,111C 'version':84C,156C 'via':7A 'victim':50B,60B,118C,123C 'without':36B,91C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted GRR before version 4.5.0 where the installation files, including maj.php, remain reachable on the web server. Instances with the installation files removed are not exposed through this path. Sources do not say whether managed hosting exists.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T23:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58205","severity":null,"published_at":"2026-10-27T23:17:05+00:00","modified_at":"2026-10-27T23:17:05+00:00","first_seen_at":"2026-10-27T23:29:44+00:00","fetched_at":"2026-10-27T23:29:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}