CVE-2026-63010
Group-Office: Stored XSS via Manual Reminders
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.172, 25.0.108, and 26.0.33, a low-privileged user can create manual reminders containing arbitrary HTML/JavaScript and assign them to any other user (including administrators). When the victim's browser polls for pending notifications, the payload renders unsanitized as innerHTML in the ExtJS notification panel, achieving Stored Cross-Site Scripting (XSS) leading to full Account Takeover (ATO) of the victim's session. This issue has been patched in versions 6.8.172, 25.0.108, and 26.0.33.
| CWE | CWE-80 CWE-79 |
| Vendor | intermesh |
| Product | groupoffice |
| Published | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for intermesh groupoffice
Be the first to know when new unknown vulnerabilities affecting intermesh groupoffice are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Intermesh / groupoffice
< 6.8.172 < 25.0.108 < 26.0.33
References
github.com: https://github.com/Intermesh/groupoffice/security/advisories/GHSA-jw34-6g49-r6cw github.com: https://github.com/Intermesh/groupoffice/releases/tag/v25.0.108 github.com: https://github.com/Intermesh/groupoffice/releases/tag/v26.0.33 github.com: https://github.com/Intermesh/groupoffice/releases/tag/v6.8.172