Stored XSS Vulnerability in Grocy's API by Vendor Grocy
CVE-2026-71236

8HIGH

Key Information:

Vendor

Grocy

Status
Grocy
Vendor
CVE Published:
5 August 2026

What is CVE-2026-71236?

Grocy's API contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of HTML-entity encoding in its request-body parser. Specifically, the API utilizes HTMLPurifier to sanitize incoming field values but incorrectly reverses entity encoding on the output. This flaw allows malicious users to inject HTML or script tags into API-writable fields, potentially compromising the security of applications that reflect this data without proper re-sanitization.

Affected Version(s)

grocy 0

References

https://github.com/grocy/grocy

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bobur Abdugafforov
.