A stored cross-site scripting vulnerability in the Grocy API parser allows authenticated attackers to execute malicious scripts, leading to potential session hijacking or unauthorized actions.

This is a stored cross-site scripting (XSS) flaw in the GetParsedAndFilteredRequestBody function. Although the application uses HTMLPurifier, it incorrectly reverses entity encoding, which reintroduces dangerous characters and allows for the execution of arbitrary JavaScript in the context of other users.

The vulnerability is rated with a CVSS score of 8.7, indicating high severity. An authenticated attacker can leverage this XSS to compromise user sessions, steal sensitive information, or perform unauthorized actions on behalf of other users. This may lead to a complete breakdown of administrative controls and potential data loss within the application.

Immediate Action: Monitor for official security updates from the Grocy GitHub repository and apply them immediately.

Proactive Monitoring: Audit API activity logs for unusual request payloads containing script tags or encoded HTML entities.

Compensating Controls: Enforce strict Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts and use a WAF to filter malicious content in API requests.

Public Exploit Available: Unknown.

While this flaw requires authentication, the impact is significant. Security teams should prioritize patching as soon as a fix is released and ensure that authentication controls are hardened to prevent malicious actors from reaching the vulnerable API endpoints.