Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Group Office - CVE-2026-63010
Published: November 9, 2026
Vulnerability identifier: #VU162759
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-63010
CWE-ID: CWE-80
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged authenticated attacker to take over another user's Group Office account, including an administrator's account.
The vulnerability exists due to unsanitized manual reminder content being rendered as HTML in the notification panel when the victim's browser automatically polls for reminders. A low-privileged authenticated attacker can create and assign a malicious reminder to any user, causing stored JavaScript to execute in that user's session without victim interaction.
Affected software
Group Office
How to mitigate CVE-2026-63010
Install security update from vendor's website.
Group Office - addressed in versions 6.8.172, 25.0.108, 26.0.33