CVE-2026-20711
Cross-Site Scripting in Cybozu Garoon Email Enables Password Reset
Publication date: 2026-02-02
Last updated on: 2026-02-19
Assigner: JPCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cybozu | garoon | From 5.0.0 (inc) to 6.0.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows attackers to execute malicious scripts that can reset arbitrary users’ passwords, which poses a risk to the integrity of user accounts.
Such unauthorized password resets and potential account compromises could lead to violations of security requirements in common standards and regulations like GDPR and HIPAA, which mandate protection of user data and access controls.
However, the provided information does not explicitly discuss the impact on compliance with these standards or regulations.
Can you explain this vulnerability to me?
This vulnerability is a cross-site scripting (XSS) flaw in the E-mail function of Cybozu Garoon versions 5.0.0 to 6.0.3. It allows an attacker to execute malicious scripts within the web browser of a user, which can lead to the attacker resetting arbitrary users' passwords without needing special privileges but requiring user interaction. [1, 2]
How can this vulnerability impact me? :
The vulnerability can allow attackers to reset arbitrary users' passwords by executing malicious scripts via the email function. This compromises the integrity of user accounts, potentially allowing unauthorized access or control over affected accounts. It does not impact confidentiality or availability but has a high impact on integrity. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade Cybozu Garoon to version 6.17.0 or later, as this version contains the fix for the vulnerability. No patches will be provided for versions prior to 6. Users should ensure they update to the latest version to protect against this cross-site scripting vulnerability. [2]