GRR: Reflected Cross-Site Scripting via maj.php
Summary
GRR, a resource management and reservation application, contains a reflected Cross-Site Scripting (XSS) flaw in maj.php. The forcemaj parameter is reflected without adequate escaping, but only if the installation files remain accessible on the server, which does not happen automatically. An attacker can send a crafted URL; when a victim opens it, arbitrary JavaScript runs in the victim's browser, enabling phishing, redirection to malicious sites, cookie theft and session hijacking, because the authentication cookie is not HttpOnly. The victim must open the link.
Affected
- GRR versions before 4.5.0
- GitHub advisory lists <= 4.4.2 as affected; VulDB describes it as up to 4.4.x
- Exposure requires the installation files (maj.php) to remain reachable
Fixed in
- Fixed in GRR 4.5.0
- Fix commit: 4ef77f91818215c1f8e0f06023d89257dfd61c68
- Backports to older branches: Unknown.
Workaround
- Remove the installation directory, or block web access to maj.php, if upgrading is not possible.
- No other vendor mitigations are documented. Setting the authentication cookie to HttpOnly would limit cookie theft, but no vendor guidance on this is available.
Exploitation
- No evidence of exploitation in the wild found; not listed in CISA KEV.
- No public proof-of-concept found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
- VulDB's '0-Day' label refers to disclosure status, not confirmed exploitation.
Our recommendation
- Upgrade all GRR instances to 4.5.0.
- Until then, check whether the installation directory exists on internet-facing GRR hosts and remove it or block access to maj.php.
- Check whether the authentication cookie can be set to HttpOnly as an interim measure, and verify this with the vendor first.
- Monitor web server logs for requests to maj.php containing unusual forcemaj values.
- Patch together with the other GRR CVEs fixed in 4.5.0, including CVE-2026-58256 (critical).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GHSA-r6x2-w38j-vvq2 advisory github.com
- Fix commit 4ef77f9 github.com
- GRR v4.5.0 tag github.com
- VulDB CVE entry vuldb.com
- OffSeq threat radar CVE-2026-58205 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:52.
Original description (NVD)
GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim's browser when the victim accesses it. This reflected cross-site scripting can enable phishing, redirection to malicious sites, cookie theft and session hijacking because the authentication cookie is not `HttpOnly`. This issue is fixed in version 4.5.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.