SB20261110234 - Multiple vulnerabilities in Group Office

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261110234

SB20261110234 - Multiple vulnerabilities in Group Office

Published: November 10, 2026 Updated: November 11, 2026

Security Bulletin ID SB20261110234
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 22% Low 78%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 vulnerabilities.


1) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-125388)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose all public-form submissions, including names, emails, and free-text answers, regardless of granted module access.

The vulnerability exists due to missing authorization checks in the Group-Office business/forms downloadReport() handler when exporting reports using user-controlled form IDs. A remote user can request api/download.php?blob=business/forms/report/1 and iterate sequential form IDs to download XLSX reports containing submissions from forms they are not authorized to access.


2) Cross-site scripting (CVE-ID: CVE-2026-125389)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute JavaScript in the Group-Office origin and take over a victim's account.

The vulnerability exists due to incomplete event-handler filtering in the email viewer when rendering message HTML directly into the application document. A remote user can send HTML email containing <svg/onload=alert(document.cookie)> and induce the victim to view the filtered message, or exploit check bypasses for senders matching contacts in writable addressbooks or messages in sent/drafts folders, to execute JavaScript when the message is opened.


3) Path traversal (CVE-ID: CVE-2026-125390)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read arbitrary files accessible to the PHP process, including database credentials and other users' stored files.

The vulnerability exists due to improper restriction of source paths in Group-Office's files/folder/processUploadQueue endpoint when processing strings in the blobs parameter without confining them to the temporary blob directory. A remote user can submit a JSON array containing absolute paths such as /etc/groupoffice/config.php and select a destination folder with CREATE permission to copy or hard-link sensitive files into their own folder for download, bypassing source-folder access controls.


4) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to overwrite and permanently destroy other users' stored file contents.

The vulnerability exists due to missing file authorization in the Group Office PDF Editor upload endpoint when resolving client-controlled fileId values, allowing overwrites before permission checks while failed backup writes are suppressed. A remote user can submit a multipart upload containing a victim's fileId and replacement content in the pdf field, or iterate sequential identifiers, to corrupt other users' files without recoverable versions.


5) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to force another user's subscribed calendar to re-sync, destroying locally modified events and temporarily disrupting event availability.

The vulnerability exists due to missing authorization in Group Office's Calendar::reload action when resolving a target calendar through Calendar::findById without checking permissions. A remote user can use calendar-module access to submit a Calendar/reload request with another user's subscribed calendar ID to trigger event deletion and re-import from its stored feed when that feed has changed since the last sync.


6) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to create or overwrite files in shared Group Office folders despite having only read permission.

The vulnerability exists due to missing write authorization in MessageController::actionSaveAttachment when saving email attachments into a selected folder using raw filesystem operations. A remote user can submit a saveAttachment request specifying a read-only folder and either an email attachment or a controlled temporary file to write unauthorized content into that folder.


7) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose other users' file metadata, including names, full paths, sizes, ownership and timestamps, but not file contents.

The vulnerability exists due to authorization bypass through user-controlled keys in Group Office's files/file/open action when resolving file paths or identifiers with ACL enforcement disabled and returning attributes without checking permissions. A remote user can submit another user's file path or identifier through the Files module to retrieve metadata without authorization.


8) External Control of File Name or Path (CVE-ID: N/A)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to overwrite other users' files within file_storage_path, cause persistent CSS injection, and potentially execute stored cross-site scripting.

The vulnerability exists due to externally controlled file paths and missing authorization in Group Office's email saveToFile action when saving messages through the raw filesystem class. A remote user can submit save_to_path with email-module access to overwrite storage files with attacker-controlled MIME messages, including customcss/style.css or customcss/javascript.js rendered globally, although MIME headers may prevent JavaScript execution.


9) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to modify installed GroupOffice state without authorization and disrupt availability.

The vulnerability exists due to missing authorization in www/install/upgrade.php when installation-maintenance endpoints remain reachable after installation. A remote attacker can send a request containing confirmed=1 to invoke privileged database upgrade logic, clear caches, disable unavailable modules, and update the stored database version.


Remediation

Install update from vendor's website.

References