CVE-2023-48197: Grocy Project Grocy

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

Cross-Site Scripting (XSS) vulnerability in the ‘manageApiKeys’ component of Grocy 4.0.3 and earlier allows attackers to obtain victim's cookies when the victim clicks on the "see QR code" function.

Affected products

• Grocy Project Grocy: version 4.0.3 only

Published 2023-11-15. Last modified 2026-06-17.