CVE-2026-63010

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.172, 25.0.108, and 26.0.33, a low-privileged user can create manual reminders containing arbitrary HTML/JavaScript and assign them to any other user (including administrators). When the victim's browser polls for pending notifications, the payload renders unsanitized as innerHTML in the ExtJS notification panel, achieving Stored Cross-Site Scripting (XSS) leading to full Account Takeover (ATO) of the victim's session. This issue has been patched in versions 6.8.172, 25.0.108, and 26.0.33.

• https://github.com/Intermesh/groupoffice/releases/tag/v25.0.108
• https://github.com/Intermesh/groupoffice/releases/tag/v26.0.33
• https://github.com/Intermesh/groupoffice/releases/tag/v6.8.172
• https://github.com/Intermesh/groupoffice/security/advisories/GHSA-jw34-6g49-r6cw

• https://github.com/Intermesh/groupoffice/releases/tag/v25.0.108
• https://github.com/Intermesh/groupoffice/releases/tag/v26.0.33
• https://github.com/Intermesh/groupoffice/releases/tag/v6.8.172
• https://github.com/Intermesh/groupoffice/security/advisories/GHSA-jw34-6g49-r6cw

• HIGHCVE-2026-57440PoC
• MEDIUMCVE-2012-20003PoC
• MEDIUMCVE-2012-20004PoC
• MEDIUMCVE-2012-20005PoC
• MEDIUMCVE-2013-20009PoC
• MEDIUMCVE-2014-125131PoC
• MEDIUMCVE-2014-125132PoC
• MEDIUMCVE-2015-20130PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.