CVE-2026-63010

{
  "etk_id": "ETK-2026-4076",
  "cve_id": "CVE-2026-63010",
  "display_id": "CVE-2026-63010",
  "ghsa_id": "GHSA-jw34-6g49-r6cw",
  "euvd_id": "EUVD-2026-121329",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in GroupOffice reminders",
  "summary": "GroupOffice releases before 6.8.172, 25.0.108, and 26.0.33 do not safely render reminder content in notifications. A low-privileged account can target another user with a malicious reminder, potentially allowing takeover of the recipient's browser session when notifications are displayed.",
  "mitigation": "Upgrade GroupOffice to 6.8.172, 25.0.108, or 26.0.33, as appropriate for the deployed release line. Until upgraded, restrict untrusted users' ability to create or assign manual reminders and monitor reminder activity.",
  "vendor": "Intermesh",
  "product": "groupoffice",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "26.0.32"
      ],
      "ecosystem": "php",
      "fixed_versions": [
        "26.0.33",
        "25.0.108",
        "6.8.172"
      ],
      "package_name": "groupoffice",
      "purl": null
    }
  ],
  "cwes": [
    80
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 27.608328866666668,
  "t0_at": "2026-11-10T16:35:20.103000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-10T17:50:24.981463+00:00",
      "days": 0.05213979702546296,
      "is_lower_bound": false,
      "measured_at": "2026-11-10T16:35:20.103000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-10T16:35:20.103000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-10T16:35:20.103000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63010"
    }
  }
}