Grocy's API request-body parser improperly reverses HTML entity encoding after sanitizing input with HTMLPurifier, which reintroduces executable HTML/script tags. This flaw leads to stored cross-site scripting (XSS) vulnerabilities in multiple API-writable fields such as products, recipes, stock, users, and chores. The vulnerability has a high severity score of 8.7 and affects confidentiality and integrity without impacting availability.