Stored Cross-Site Scripting Vulnerability in Group-Office by Intermesh
CVE-2026-63010
8.7HIGH
What is CVE-2026-63010?
A significant vulnerability exists in Group-Office that allows low-privileged users to create manual reminders containing untrusted HTML/JavaScript. When these reminders are sent, they can execute as unsanitized innerHTML within the ExtJS notification panel viewed by other users, including administrators. This vulnerability could lead to a Stored Cross-Site Scripting (XSS) attack, resulting in the potential for a full Account Takeover (ATO) of affected users' sessions. This issue has been resolved in the latest releases, so users are advised to update to versions 6.8.172, 25.0.108, or 26.0.33.
Affected Version(s)
groupoffice < 6.8.172 < 6.8.172
groupoffice < 25.0.108 < 25.0.108
groupoffice < 26.0.33 < 26.0.33