Threat Intelligence Database

Group-Office is an enterprise customer relationship management and groupware tool. Prior to 26.0.25, 25.0.100, and 6.8.165, GroupOffice allows authenticated users to persist arbitrary legacy settings for any user_id via index.php?r=core/saveSetting. A separate client-side sink in the email module injects the email_font_size setting directly into JavaScript without escaping. By combining these two issues, any low-privileged authenticated user can overwrite an administrator's email_font_size setting with a JavaScript payload and trigger stored XSS in the administrator's browser when the GroupOffice web client loads views/Extjs3/modulescripts.php. This vulnerability is fixed in 26.0.25, 25.0.100, and 6.8.165.

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.156, 25.0.90, and 26.0.12, a vulnerability in the AbstractSettingsCollection model leads to insecure deserialization when these settings are loaded. By injecting a serialized FileCookieJar object into a setting string, an authenticated attacker can achieve Arbitrary File Write, leading directly to Remote Code Execution (RCE) on the server. This issue has been patched in versions 6.8.156, 25.0.90, and 26.0.12.

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.158, 25.0.92, and 26.0.17, an authenticated SQL Injection vulnerability in the JMAP `Contact/query` endpoint allows any authenticated user with basic addressbook access to extract arbitrary data from the database — including active session tokens of other users. This enables full account takeover of any user, including the System Administrator, without knowing their password. Versions 6.8.158, 25.0.92, and 26.0.17 fix the issue.

HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-33755#cwe-89

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in GroupOffice on the external/index flow. The f parameter (Base64 JSON) is decoded and then injected into an inline JavaScript block without strict escaping, allowing </script><script>...</script> injection and arbitrary JavaScript execution in the victim's browser. This issue has been patched in versions 6.8.155, 25.0.88, and 26.0.10.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-30238#cwe-79

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in the GroupOffice installer, endpoint install/license.php. The POST field license is rendered without escaping inside a <textarea>, allowing a </textarea><script>...</script> breakout.. This issue has been patched in versions 6.8.155, 25.0.88, and 26.0.10.

LowVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-30237#cwe-79

Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.9, 25.0.87, and 6.8.154 have an authenticated Remote Code Execution vulnerability in the TNEF attachment processing flow. The vulnerable path extracts attacker-controlled files from `winmail.dat` and then invokes `zip` with a shell wildcard (`*`). Because extracted filenames are attacker-controlled, they can be interpreted as `zip` options and lead to arbitrary command execution. Versions 26.0.9, 25.0.87, and 6.8.154 fix the issue.

CriticalVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-27947#cwe-88

Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.8, 25.0.87, and 6.8.153 have a SQL Injection (SQLi) vulnerability, exploitable through the `advancedQueryData` parameter (`comparator` field) on an authenticated endpoint. The endpoint `index.php?r=email/template/emailSelection` processes `advancedQueryData` and forwards the SQL comparator without a strict allowlist into SQL condition building. This enables blind boolean-based exfiltration of the `core_auth_password` table. Versions 26.0.8, 25.0.87, and 6.8.153 fix the issue.

HighVulnerabilityUnited StatesGermanyUnited Kingdom+8#cve#cve-2026-27832#cwe-89

CVE-2026-25511 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in Intermesh's Group-Office product affecting versions prior to 6.8.150, 25.0.82, and 26.0.5. An authenticated user with System Administrator privileges can exploit the WOPI service discovery URL to perform SSRF attacks, including accessing internal hosts and ports. The vulnerability allows exfiltration of SSRF response bodies via the built-in debug system, effectively making the SSRF visible and enabling full server-side file read. No user interaction is required beyond authentication, and the vulnerability does not require additional privileges beyond System Administrator access.

HighVulnerabilityGermanyFranceNetherlands+4#cve#cve-2026-25511#cwe-918

CVE-2026-25512 is a critical remote code execution vulnerability in Intermesh Group-Office versions prior to 6.8.150, 25.0.82, and 26.0.5. The flaw arises from improper neutralization of special elements in the tmp_file parameter, which is directly concatenated into an exec() system call within the email/message/tnefAttachmentFromTempFile endpoint. An authenticated attacker can exploit this by injecting shell metacharacters to execute arbitrary commands on the server without user interaction. This vulnerability impacts confidentiality, integrity, and availability of affected systems.

CriticalVulnerabilityGermanyFranceNetherlands+5#cve#cve-2026-25512#cwe-78

Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceController exposes an action zipLanguage which takes a lang parameter and passes it directly to a system zip command via exec(). This can be combined with uploading a crafted zip file to achieve remote code execution. This vulnerability is fixed in 6.8.150, 25.0.82, and 26.0.5.

CriticalVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2026-25134#cwe-88