A high-severity cross-site scripting vulnerability in grocy could allow authenticated attackers to execute unauthorized scripts.

The API request-body parser in the BaseApiController contains a flaw that facilitates cross-site scripting (XSS). This requires the attacker to be authenticated, though the resulting impact can involve the execution of malicious scripts within the victim's browser session.

With a CVSS score of 8.7, this vulnerability poses a significant risk to user data and session integrity. Successful exploitation could lead to unauthorized actions performed on behalf of a user, data theft, or session hijacking. While it requires authentication, the potential for lateral movement or administrative account compromise remains high.

Immediate Action: Apply the latest vendor security updates as soon as they are made available to address the parser vulnerability.

Proactive Monitoring: Review audit logs for suspicious API requests or unusual user activity that may indicate an attempt to inject malicious scripts.

Compensating Controls: Employ a robust Content Security Policy (CSP) to mitigate the impact of potential cross-site scripting attacks.

Public Exploit Available: Unknown

Organizations should monitor the vendor's security updates closely and apply the patch as soon as it is released. In the interim, ensure strong authentication practices are in place and restrict access to the application API to minimize the attack surface.