A client‑side cross‑site scripting flaw exists in the Message function of Cybozu Garoon versions 5.15.0 through 6.0.3. The flaw allows an attacker to insert malicious script that triggers a password reset for any user, thereby compromising account integrity and potentially threatening confidentiality if the attacker obtains the new credentials. This vulnerability is categorized as CWE‑79, an example of insufficient input validation leading to script injection.

Cybozu, Inc. products Cybozu Garoon versions 5.15.0 to 6.0.3 are affected. Users deploying any of these releases need to verify their version and apply an update if one is available.

With a base CVSS score of 6.8, this vulnerability is considered medium severity. The EPSS score of less than 1% indicates that, at present, the likelihood of exploitation is very low, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The exploit would likely be carried out through a client‑side attack vector, requiring the attacker to deliver crafted content to a user with an active session. Verification of an active session or authentication may be necessary to successfully reset passwords. In the absence of a public exploit, the risk remains moderate until a exploit is detected.