CVE-2026-63010

Group-Office is an enterprise customer relationship management and groupware tool.

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.172, 25.0.108, and 26.0.33, a low-privileged user can create manual reminders containing arbitrary HTML/JavaScript and assign them to any other user (including administrators). When the victim's browser polls for pending notifications, the payload renders unsanitized as innerHTML in the ExtJS notification panel, achieving Stored Cross-Site Scripting (XSS) leading to full…

10. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-63010