{"id":"CVE-2026-63010","kind":"vulnerability","aliases":["CVE-2026-63010"],"related":[],"title":"Group-Office: reminders can inject scripts that take over other users' sessions","description":"Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.172, 25.0.108, and 26.0.33, a low-privileged user can create manual reminders containing arbitrary HTML/JavaScript and assign them to any other user (including administrators). When the victim's browser polls for pending notifications, the payload renders unsanitized as innerHTML in the ExtJS notification panel, achieving Stored Cross-Site Scripting (XSS) leading to full Account Takeover (ATO) of the victim's session. This issue has been patched in versions 6.8.172, 25.0.108, and 26.0.33.","summary":"Group-Office, a customer relationship and groupware tool, renders reminder text as raw HTML in the notification panel. A low-privileged user can create a reminder with JavaScript and assign it to any user, including administrators, so the script runs in the victim's browser and can take over their session.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Group-Office","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["group-office","other","self-hosted"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed Group-Office version against the fixed versions listed below.","fix":"- Upgrade to `6.8.172`, `25.0.108`, or `26.0.33`, matching your release line.","status":"open","published_at":"2026-11-10T17:17:45+00:00","first_seen_at":"2026-11-10T17:22:44+00:00","triaged_at":"2026-11-10T17:23:47+00:00","updated_at":"2026-11-10T17:23:47+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-10T17:23:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `6.8.172`, `25.0.108`, or `26.0.33`, matching your release line.","reach":"network","title":"Group-Office: reminders can inject scripts that take over other users' sessions","impact":"high","summary":"Group-Office, a customer relationship and groupware tool, renders reminder text as raw HTML in the notification panel. A low-privileged user can create a reminder with JavaScript and assign it to any user, including administrators, so the script runs in the victim's browser and can take over their session.","audience":"businesses","category":"other","nicknames":[],"who_cares":["group-office","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"victim session hijacked, including administrator accounts","analyst_note":"Confirm the affected release lines and whether the fixed versions are the only remediation; check the linked GitHub release notes and vendor advisory.","how_to_check":"- Check the installed Group-Office version against the fixed versions listed below.\n- unknown","plain_action":"","product_name":"Group-Office","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"Any Group-Office instance where users can create manual reminders is exposed, since a low-privileged account is enough to plant the payload. Instances with only administrator accounts or no user-created reminders carry less exposure. unknown for other configuration details.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000738,"input_tokens":4710,"output_tokens":534,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-63010':16A,19A '25.0.108':99C,169C '26.0.33':101C,171C '6.8.172':98C,168C 'account':153C 'achiev':143C 'administr':67B,122C 'arbitrari':112C 'assign':61B,115C 'ato':155C 'browser':76B,127C 'contain':111C 'creat':55B,108C 'cross':146C 'cross-sit':145C 'custom':34B,89C 'cve':14A,17A 'enterpris':88C 'extj':140C 'full':152C 'group':2A,21A,24B,31B,84C 'group-offic':1A,23B,30B,83C 'group-office':20A 'groupwar':37B,93C 'host':29B 'html':44B 'html/javascript':113C 'includ':66B,121C 'inject':6A 'innerhtml':137C 'issu':162C 'javascript':59B 'lead':150C 'low':51B,104C 'low-privileg':50B,103C 'manag':91C 'manual':109C 'notif':47B,131C,141C 'offic':3A,25B,32B,85C 'office':22A 'panel':48B,142C 'patch':165C 'payload':133C 'pend':130C 'poll':128C 'prior':95C 'privileg':52B,105C 'raw':43B 'relationship':35B,90C 'remind':4A,40B,57B,110C 'render':39B,134C 'run':71B 'script':7A,70B,148C 'self':28B 'self-host':27B 'session':13A,82B,160C 'site':147C 'store':144C 'take':9A,79B 'takeov':154C 'text':41B 'tool':38B,94C 'unsanit':135C 'user':12A,53B,65B,106C,120C 'version':97C,167C 'victim':74B,125C,158C 'xss':149C","nicknames":[],"mitigations":[],"who_affected":"Any Group-Office instance where users can create manual reminders is exposed, since a low-privileged account is enough to plant the payload. Instances with only administrator accounts or no user-created reminders carry less exposure. unknown for other configuration details.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["groupoffice"],"ptokens":["group","office"],"labels":["groupoffice","high","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':15A,18A '-63010':16A,19A 'cve':14A,17A 'group':2A,21A 'group-offic':1A 'group-office':20A 'inject':6A 'offic':3A 'office':22A 'remind':4A 'script':7A 'session':13A 'take':9A 'user':12A","search_b":"'administr':67B 'assign':61B 'browser':76B 'creat':55B 'custom':34B 'group':24B,31B 'group-offic':23B,30B 'groupwar':37B 'host':29B 'html':44B 'includ':66B 'javascript':59B 'low':51B 'low-privileg':50B 'notif':47B 'offic':25B,32B 'panel':48B 'privileg':52B 'raw':43B 'relationship':35B 'remind':40B,57B 'render':39B 'run':71B 'script':70B 'self':28B 'self-host':27B 'session':82B 'take':79B 'text':41B 'tool':38B 'user':53B,65B 'victim':74B","search_c":"'25.0.108':99C,169C '26.0.33':101C,171C '6.8.172':98C,168C 'account':153C 'achiev':143C 'administr':122C 'arbitrari':112C 'assign':115C 'ato':155C 'browser':127C 'contain':111C 'creat':108C 'cross':146C 'cross-sit':145C 'custom':89C 'enterpris':88C 'extj':140C 'full':152C 'group':84C 'group-offic':83C 'groupwar':93C 'html/javascript':113C 'includ':121C 'innerhtml':137C 'issu':162C 'lead':150C 'low':104C 'low-privileg':103C 'manag':91C 'manual':109C 'notif':131C,141C 'offic':85C 'panel':142C 'patch':165C 'payload':133C 'pend':130C 'poll':128C 'prior':95C 'privileg':105C 'relationship':90C 'remind':110C 'render':134C 'script':148C 'session':160C 'site':147C 'store':144C 'takeov':154C 'tool':94C 'unsanit':135C 'user':106C,120C 'version':97C,167C 'victim':125C,158C 'xss':149C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-02T06:47:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63010","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63010","severity":null,"published_at":"2026-11-10T17:17:45+00:00","modified_at":"2026-11-10T17:17:45+00:00","first_seen_at":"2026-11-10T17:22:44+00:00","fetched_at":"2026-11-10T17:22:44+00:00","note":null}],"documents":[{"id":116524,"url":"https://github.com/Intermesh/groupoffice/releases/tag/v25.0.108","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":116525,"url":"https://github.com/Intermesh/groupoffice/releases/tag/v26.0.33","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":116526,"url":"https://github.com/Intermesh/groupoffice/releases/tag/v6.8.172","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":116527,"url":"https://github.com/Intermesh/groupoffice/security/advisories/GHSA-jw34-6g49-r6cw","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-02T06:47:11+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}