---
id: CVE-2026-58205
title: GRR has a Reflected XSS issue
summary: >-
  GRR is a resource management and reservation application. Prior to version
  4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping
  when installation files remain accessible. Removal of these files is not
  automatic. A…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: JeromeDevome
product: GRR
affected:
  - GRR < 4.5.0
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T22:26:14.705Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-58205'
references:
  - url: >-
      https://github.com/JeromeDevome/GRR/security/advisories/GHSA-r6x2-w38j-vvq2
    label: >-
      https://github.com/JeromeDevome/GRR/security/advisories/GHSA-r6x2-w38j-vvq2
  - url: >-
      https://github.com/JeromeDevome/GRR/commit/4ef77f91818215c1f8e0f06023d89257dfd61c68
    label: >-
      https://github.com/JeromeDevome/GRR/commit/4ef77f91818215c1f8e0f06023d89257dfd61c68
  - url: 'https://github.com/JeromeDevome/GRR/tree/v4.5.0'
    label: 'https://github.com/JeromeDevome/GRR/tree/v4.5.0'
tags:
  - cve.org
ingestedAt: '2026-10-27T22:58:58.457Z'
---

## Overview

GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim's browser when the victim accesses it. This reflected cross-site scripting can enable phishing, redirection to malicious sites, cookie theft and session hijacking because the authentication cookie is not `HttpOnly`. This issue is fixed in version 4.5.0.

## Affected

- `GRR < 4.5.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.