What is the CVSS score of CVE-2026-22888?

CVE-2026-22888 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Garoon are affected by CVE-2026-22888?

CVE-2026-22888 affects Garoon and allows attackers to modify portal settings, potentially denying legitimate users access to critical collaboration platforms.

How to fix or mitigate CVE-2026-22888?

Within 24 hours: Identify all Garoon instances in your environment and assess exposure; isolate systems from untrusted networks if possible and enable audit logging for portal configuration changes. Within 7 days: Implement network-level access controls restricting administrative portal access to known IP ranges; deploy monitoring alerts for unauthorized portal setting modifications. Within 30 days: Evaluate alternative collaboration platforms; coordinate with Cybozu for patch availability and develop a patching timeline; conduct security review of Garoon administrative practices and access controls.

Garoon CVE-2026-22888

HIGH

Improper Handling of Extra Values (CWE-231)

2026-02-02 vultures@jpcert.or.jp

Authentication Bypass Garoon

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

CVE Published

Feb 02, 2026 - 07:16 nvd

HIGH 7.5

DescriptionCVE.org

Improper input verification issue exists in Cybozu Garoon 5.0.0 to 6.0.3, which may lead to unauthorized alteration of portal settings, potentially blocking access to the product.

AnalysisAI

Garoon contains a vulnerability that allows attackers to unauthorized alteration of portal settings, potentially blocking access to the p (CVSS 7.5).

Technical ContextAI

affects Garoon. Improper input verification issue exists in Cybozu Garoon 5.0.0 to 6.0.3, which may lead to unauthorized alteration of portal settings, potentially blocking access to the product.