CVE-2026-71236

Name of the Vulnerable Software and Affected Versions Grocy (affected versions not specified)

Description Stored Cross-Site Scripting (XSS) occurs due to an issue in the API request-body parser within controllers/Api/BaseApiController.php in the GetParsedAndFilteredRequestBody() function. The system purifies incoming field values using HTMLPurifier but subsequently reverses the HTML-entity encoding by replacing <, >, and & back to <, >, and &. This process reconstructs active HTML and script tags that were previously neutralized, allowing malicious scripts to be stored in API-writable fields such as products, recipes, stock, users, and chores, which are then executed when rendered without further sanitization.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.