Cybozu Garoon versions 5.0.0 through 6.0.3 contain a cross‑site scripting flaw in the email handling component that enables an attacker to inject malicious scripts. The injected scripts can trigger password‑reset functionality for arbitrary users, effectively allowing an attacker to take over other accounts. The weakness falls under CWE‑79 and impacts the integrity of user credentials and the availability of legitimate accounts.

The affected product is Cybozu Garoon, produced by Cybozu, Inc., for all releases between 5.0.0 and 6.0.3 inclusive. These are internal collaboration and project‑management platforms used by organizations that host Garoon on their own infrastructure.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1% signals exceedingly low exploitation probability at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. While the official attack vector is not stated, it is inferred that an attacker could embed the XSS payload in an email sent through Garoon’s email function, thereby executing the malicious script in the target’s browser when the email is viewed.