Threats tagged 'ghsa-mp2v-gg3m-qvpx'

Intermesh Group-Office versions prior to 6.8.181, 25.0.116, and 26.0.58 have a missing authorization vulnerability. Authenticated users can exploit this flaw to download form reports via the api/download.php endpoint without proper permission checks. This allows unauthorized export of form submissions as XLSX files, potentially disclosing sensitive data.