Cybozu Garoon Schedule Module Cross-Site Scripting Vulnerability (CVE-2026-57279)

Vulnerability Overview Vulnerability Name: [CyVDB-4148] Cross-Site Scripting Vulnerability Related to Schedules (CVE-2026-57279) Vulnerability Type: CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) CVSS Score: 6.8 (Medium/Warning) Attack Vector: Network Attack Complexity: Low Required Privileges: Low User Interaction: Required Scope: Changed Confidentiality Impact: None Integrity Impact: High Availability Impact: None Affected Versions Affected Versions: 6.17.0, 6.17.1 Fixed Version: 6.17.2 Disclosure Date: 2026-07-31 Update Date: 2026-07-31 Remediation Mitigation: Upgrade to Garoon version 6.17.2. Additional Information Vulnerability Description: This vulnerability may allow arbitrary scripts to be executed in a web browser using Garoon. CVSS v3: https://www.ipa.go.jp/security/vuln/CVSSv3.html CVE-ID: CVE-2026-57279 Disclosure Policy: https://cybozu.co.jp/company/security-policy/ CVSS Base Value: Vulnerabilities with a CVSS base value of 6.0 or higher are disclosed on JVN. Response Policy: Patches will be released for Garoon 6 and later versions; no patches will be released for Garoon 5 and earlier versions. Vulnerabilities with a CVSS base value of 6.9 or below (Level 2 Warning) will not be addressed in older versions of Garoon. Related Links Garoon Vulnerability Response Policy: https://garoon.cybozu.co.jp/support/packagelupdate/policy Article Feedback Was this helpful?: Yes / No Footer Information What is the Defect Information Disclosure Site?: Provides public information regarding software defects. Crisis Management Information Display: Provides crisis management-related information. Incident Information: Provides incident information. Contact Us: Provides contact details. Personal Information Protection Policy: Provides the personal information protection policy. Terms of Use: Provides the terms of use. Copyright © Cybozu, Inc. All rights reserved.

Goal Reached Thanks to every supporter — we hit 100%!

Cybozu Garoon Schedule Module Cross-Site Scripting Vulnerability (CVE-2026-57279)