---
id: "CVE-2026-63010"
page: "https://infrastack.ai/live/CVE-2026-63010"
kind: "vulnerability"
aliases: ["CVE-2026-63010"]
title: "Group-Office: reminders can inject scripts that take over other users' sessions"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Group-Office", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["group-office", "other", "self-hosted"]
not_affected_if: ["patched-version"]
published_at: "2026-11-10T17:17:45+00:00"
first_seen_at: "2026-11-10T17:22:44+00:00"
updated_at: "2026-11-10T17:23:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63010", "first_seen_at": "2026-11-10T17:22:44+00:00"}]
exploit_sources: []
---

# Group-Office: reminders can inject scripts that take over other users' sessions

Link for people: https://infrastack.ai/live/CVE-2026-63010 (this .md is for agents)

Group-Office, a customer relationship and groupware tool, renders reminder text as raw HTML in the notification panel. A low-privileged user can create a reminder with JavaScript and assign it to any user, including administrators, so the script runs in the victim's browser and can take over their session.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Group-Office affected range not listed fixed no fixed version listed

## How to check

- Check the installed Group-Office version against the fixed versions listed below.

## Fix

- Upgrade to `6.8.172`, `25.0.108`, or `26.0.33`, matching your release line.

## Timeline

- 2026-11-10T17:22:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63010

## Documents

- [advisory] Vendor advisory: github.com https://github.com/Intermesh/groupoffice/security/advisories/GHSA-jw34-6g49-r6cw
- [fix] Release notes: github.com https://github.com/Intermesh/groupoffice/releases/tag/v25.0.108
- [fix] Release notes: github.com https://github.com/Intermesh/groupoffice/releases/tag/v26.0.33
- [fix] Release notes: github.com https://github.com/Intermesh/groupoffice/releases/tag/v6.8.172

## From the sources

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.172, 25.0.108, and 26.0.33, a low-privileged user can create manual reminders containing arbitrary HTML/JavaScript and assign them to any other user (including administrators). When the victim's browser polls for pending notifications, the payload renders unsanitized as innerHTML in the ExtJS notification panel, achieving Stored Cross-Site Scripting (XSS) leading to full Account Takeover (ATO) of the victim's session. This issue has been patched in versions 6.8.172, 25.0.108, and 26.0.33.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_