{"id":"CVE-2026-58205","title":"GRR has a Reflected XSS issue","summary":"GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. A…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"JeromeDevome","product":"GRR","affected":["GRR < 4.5.0"],"published":"2026-10-27","updated":"2026-10-27","sourceUpdated":"2026-10-27T22:26:14.705Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-58205","references":[{"url":"https://github.com/JeromeDevome/GRR/security/advisories/GHSA-r6x2-w38j-vvq2","label":"https://github.com/JeromeDevome/GRR/security/advisories/GHSA-r6x2-w38j-vvq2"},{"url":"https://github.com/JeromeDevome/GRR/commit/4ef77f91818215c1f8e0f06023d89257dfd61c68","label":"https://github.com/JeromeDevome/GRR/commit/4ef77f91818215c1f8e0f06023d89257dfd61c68"},{"url":"https://github.com/JeromeDevome/GRR/tree/v4.5.0","label":"https://github.com/JeromeDevome/GRR/tree/v4.5.0"}],"tags":["cve.org"],"ingestedAt":"2026-10-27T22:58:58.457Z","slug":"CVE-2026-58205","body":"## Overview\n\nGRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim's browser when the victim accesses it. This reflected cross-site scripting can enable phishing, redirection to malicious sites, cookie theft and session hijacking because the authentication cookie is not `HttpOnly`. This issue is fixed in version 4.5.0.\n\n## Affected\n\n- `GRR < 4.5.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}