CVE-2026-58205: GRR has a Reflected XSS issue
GRR is a resource management and reservation application. Prior to version 4.5.0, maj.php reflects the forcemaj parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim's browser when the victim accesses it. This reflected cross-site scripting can enable phishing, redirection to malicious sites, cookie theft and session hijacking because the authentication cookie is not HttpOnly. This issue is fixed in version 4.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GRRto a version that resolves this vulnerability.Fixed in 4.5.0
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
GRR deployments running a version prior to 4.5.0 are exposed if installation files remain accessible. Their removal is not automatic.
What must an attacker do to exploit the issue?
An attacker can craft a URL containing a malicious forcemaj parameter and must convince a victim to access that URL. No attacker authentication is required, but victim interaction is required.
What is the recommended remediation?
Upgrade GRR to version 4.5.0. Also ensure installation files are removed or otherwise no longer accessible.
Why can this issue lead to account compromise?
Injected JavaScript runs in the victim's browser and may steal cookies or hijack sessions. The authentication cookie is not HttpOnly, making it accessible to script.