What is the CVSS score of CVE-2026-71236?

CVE-2026-71236 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Grocy are affected by CVE-2026-71236?

Grocy's API contains a stored cross-site scripting vulnerability (CVE-2026-71236, CVSS 8.7) allowing authenticated users to inject and persistently execute malicious scripts within shared application…

How to fix or mitigate CVE-2026-71236?

Within 24 hours: inventory all Grocy instances and current versions in production, restrict API access to essential personnel, and document user roles and permissions. Within 7 days: deploy Web Application Firewall (WAF) rules to block script injection patterns (script tags, event handlers, JavaScript protocols) at the API layer, enable full-payload API request logging, and audit stored application data for existing injected content. Within 30 days: implement Content Security Policy headers and output HTML entity encoding on all record display endpoints, establish API anomaly detection dashboards, monitor for suspicious API modification patterns, and evaluate upgrade timeline pending vendor release of a patched Grocy version.

Grocy CVE-2026-71236

EUVD-2026-53309 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-05 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

GHSA-c924-wcfj-cr8j

PHP XSS

8.7

CVSS 3.1 · Vendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Severity by source

Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

API write requires authenticated session (PR:L); victim must view stored content (UI:R); stored XSS crosses user boundary (S:C) enabling session theft (C:H) and content manipulation (I:H).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).

CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 11:36 vuln.today

CVE Published

Aug 05, 2026 - 11:16 cve.org

HIGH 8.7

DescriptionCVE.org

Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &lt;, &gt;, and &amp; back to <, >, and & immediately after purification. This double-decode reconstructs live HTML/script tags from the entity-encoded form that HTMLPurifier produced to neutralize them, re-introducing stored XSS across API-writable fields (products, recipes, stock, users, chores, and others) that are rendered elsewhere without re-sanitization.

AnalysisAI

Stored XSS in Grocy's API layer allows authenticated users to permanently inject arbitrary script tags into shared application data, executing in the browsers of any user who views affected records. The vulnerability spans all API-writable resource types - products, recipes, stock entries, user records, and chores - making it broadly exploitable across the application. The CVSS score of 8.7 with Scope:Changed reflects the cross-user impact characteristic of stored XSS: a single low-privileged write yields high confidentiality and integrity impact against other users' sessions. No public exploit code or CISA KEV listing is identified at time of analysis.

Technical ContextAI

Grocy is a self-hosted PHP ERP for household and grocery management, with an API layer rooted in controllers/Api/BaseApiController.php. The vulnerable function GetParsedAndFilteredRequestBody applies HTMLPurifier to incoming API field values, which is the correct first step - HTMLPurifier converts dangerous characters like < and > into their HTML-entity equivalents (<, >) to neutralize them. However, the code then explicitly reverses this neutralization by performing string replacements: &lt; → <, &gt; → >, and &amp; → &. This post-processing step reconstructs the exact HTML/script tags that HTMLPurifier was designed to eliminate. The root cause maps to CWE-79 (Improper Neutralization of Input During Web Page Generation) - specifically a sanitization bypass via developer-introduced double-decode. The affected CPE is not formally registered in NVD; the product is identified via its GitHub repository at https://github.com/grocy/grocy. Because the stored content is rendered elsewhere in the application without re-sanitization, the injected payload persists and fires for all users who encounter the record.

RemediationAI

The primary fix is to remove or disable the post-HTMLPurifier entity-reversal logic in controllers/Api/BaseApiController.php - specifically, the string replacement calls that convert &lt; back to <, &gt; back to >, and &amp; back to &. HTMLPurifier's encoded output should be stored and rendered as-is, or the application should adopt a single, trusted sanitization pass at display time rather than at input time. No vendor-released patched version has been identified from available data; administrators should monitor the Grocy GitHub repository at https://github.com/grocy/grocy for commits addressing this issue. As a compensating control pending a patch, administrators of multi-user instances should restrict API write access to trusted accounts only, reducing the pool of users who can introduce malicious payloads. Restricting API authentication to administrator-level accounts removes the PR:L attack surface but may break integrations. Single-user self-hosted deployments face lower risk since the attacker and victim are the same person.