Cybozu Garoon Multiple CVEs Advisory: XSS and Input Validation Issues

Vulnerability Key Information Vulnerability ID: JVN#35265756 Affected Products: - CVE-2026-20711, CVE-2026-22888: Cybozu Garoon 5.0.0 to 6.0.3 - CVE-2026-22881: Cybozu Garoon 5.15.0 to 6.0.3 Vulnerability Description: - Cross-Site Scripting in Email (CWE-79): - CVSS Score: 6.9 (CVSS:4.0) and 6.5 (CVSS:3.0) - CVE: CVE-2026-20711 - CyVDB ID: CyVDB-3687 - Cross-Site Scripting in Messages (CWE-79): - CVSS Score: 6.8 (CVSS:4.0) and 5.7 (CVSS:3.0) - CVE: CVE-2026-22881 - CyVDB ID: CyVDB-3689 - Insufficient Input Validation in Portal Settings (CWE-231): - CVSS Score: 6.9 (CVSS:4.0) and 4.9 (CVSS:3.0) - CVE: CVE-2026-22888 - CyVDB ID: CyVDB-3995 Impact: - Attackers can exploit cross-site scripting vulnerabilities to reset passwords for any user. (CVE-2026-20711, CVE-2026-22881) - Data related to portal settings may be tampered with, potentially blocking access to the product. (CVE-2026-22888) Solution: Update the software to the latest version. Vendor Status: - Vendor: Cybozu, Inc. - Status: Vulnerability exists - Last Updated: 2026/02/02 - Vendor Note: Cybozu, Inc. official website Vulnerability Report: - CVE-2026-20711 reported by Masato Kinugawa. - CVE-2026-22881, CVE-2026-22888 reported by Cybozu, Inc. CVE ID: CVE-2026-20711, CVE-2026-22881, CVE-2026-22888 JVN iPedia ID: JVNDB-2026-000012 Update History: - 2026/02/02: Information in the [Description] section was corrected. Copyright: © 2000-2026 JPCERT/CC and IPA. All rights reserved.

Goal Reached Thanks to every supporter — we hit 100%!

Cybozu Garoon Multiple CVEs Advisory: XSS and Input Validation Issues