GROUP-OFFICE · CVE-2026-63010 · Other
NO FIX YET · SEE WHAT TO DO
Group-Office, a customer relationship and groupware tool, renders reminder text as raw HTML in the notification panel. A low-privileged user can create a reminder with JavaScript and assign it to any user, including administrators, so the script runs in the victim's browser and can take over their session.
first public Jul 2, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any Group-Office instance where users can create manual reminders is exposed, since a low-privileged account is enough to plant the payload. Instances with only administrator accounts or no user-created reminders carry less exposure. unknown for other configuration details.
Not affected if patched-version
Who cares group-office, self-hosted
6.8.172, 25.0.108, or 26.0.33, matching your release line.Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.172, 25.0.108, and 26.0.33, a low-privileged user can create manual reminders containing arbitrary HTML/JavaScript and assign them to any other user (including administrators). When the victim's browser polls for pending notifications, the payload renders unsanitized as innerHTML in the ExtJS notification panel, achieving Stored Cross-Site Scripting (XSS) leading to full Account Takeover (ATO) of the victim's session. This issue has been patched in versions 6.8.172, 25.0.108, and 26.0.33.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.