CVE-2026-22881: XSS
Published Feb 2, 2026
·Updated
Cross-site scripting vulnerability exists in Message function of Cybozu Garoon 5.15.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords.
Affected Software
2 affected components
Cybozu Garoon>=5.15.0<=6.0.3
Cybozu Garoon>=5.15.0<6.0.3
Event History
Feb 2, 2026
CVE Published
via MITRE·06:37 AM
Data Sourced
via MITRE·06:37 AM
DescriptionSeverity
Data Sourced
via NVD·07:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-22881?
CVE-2026-22881 is classified as a medium severity cross-site scripting vulnerability.
2
How do I fix CVE-2026-22881?
To fix CVE-2026-22881, update Cybozu Garoon to version 6.0.4 or later.
3
What products are affected by CVE-2026-22881?
CVE-2026-22881 affects Cybozu Garoon versions from 5.15.0 to 6.0.3.
4
What kind of attack can be executed through CVE-2026-22881?
An attacker can use CVE-2026-22881 to perform cross-site scripting attacks that may lead to resetting users’ passwords.
5
Is CVE-2026-22881 still exploitable in the latest version of Cybozu Garoon?
No, CVE-2026-22881 is not exploitable in versions of Cybozu Garoon released after 6.0.3.