CVE-2026-71236 Details
Description
Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &lt;, &gt;, and &amp; back to <, >, and & immediately after purification.
A vulnerability exists in Grocy's API request-body parser, specifically in the BaseApiController.php file. The issue arises because the parser uses HTMLPurifier to sanitize incoming field values but then manually reverses this purification by decoding HTML entities back to their original characters. This double-decoding process restores HTML or script tags that were neutralized, reintroducing stored cross-site scripting (XSS) vulnerabilities into API-writable fields such as products, recipes, stock, users, chores, and others. The flaw is present in Grocy versions prior to 4.6.0.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/grocy/grocy | TuranSec | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| Grocy | <= 4.6.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |