VulnerabilityPublished 4 Dec 2023Updated 29 Sep 2025

CVE-2023-48866: A Cross-Site Scripting (XSS)

Source CVE Database V5

Not known to be exploited.

Data as of 26 Oct 2026, 14:05 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.6% chance of exploitation in 30 days – higher than 52% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 4 Dec 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

European organizations should immediately audit their Grocy installations to determine if they are running version 4.0.3 or earlier. Until an official patch is released, administrators should consider the following mitigations: 1) Restrict access to the Grocy web interface to trusted networks or VPNs to reduce exposure to external attackers. 2) Implement web application firewalls (WAF) with rules designed to detect and block common XSS attack patterns targeting the affected endpoints. 3) Educate users about the risks of clicking on suspicious links or inputting untrusted data into Grocy components. 4) Review and sanitize any user-generated content in the recipe and shopping list notes to remove potentially malicious scripts. 5) Monitor logs for unusual activity or repeated access attempts to the vulnerable API endpoints. 6) Stay informed about official patches or updates from the Grocy project and apply them promptly once available. 7) Consider deploying Content Security Policy (CSP) headers to limit the execution of unauthorized scripts within the Grocy web interface.

Description

A Cross-Site Scripting (XSS) vulnerability in the recipe preparation component within /api/objects/recipes and note component within /api/objects/shopping_lists/ of Grocy <= 4.0.3 allows attackers to obtain the victim's cookies.

Impact

For European organizations using Grocy, particularly small to medium enterprises or community groups managing inventory and household resources, this vulnerability could lead to unauthorized access to user sessions and potentially sensitive operational data. The theft of cookies could allow attackers to impersonate legitimate users, leading to data manipulation, unauthorized changes in inventory or shopping lists, and potential exposure of internal processes. Since Grocy is often self-hosted, organizations with less mature IT security practices may be more vulnerable to exploitation. The impact extends beyond data confidentiality to include integrity and availability if attackers modify or delete critical data. Additionally, organizations subject to GDPR must consider the regulatory implications of a data breach resulting from this vulnerability, including potential fines and reputational damage. The absence of known exploits suggests a window of opportunity for proactive mitigation, but also means that attackers could develop exploits targeting European deployments, especially where Grocy is integrated into business workflows.

References

Community reviews

Loading reviews…