SB20261110253 - Multiple vulnerabilities in Group Office

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261110253

SB20261110253 - Multiple vulnerabilities in Group Office

Published: November 10, 2026 Updated: November 11, 2026

Security Bulletin ID SB20261110253
CSH Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 33% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary JavaScript in a victim's Group Office session, potentially take over their account, and destroy global synchronization state.

The vulnerability exists due to unvalidated static-method dispatch and improper output neutralization in the site module's actionAjaxWidget() when handling unauthenticated requests containing class and method names. A remote attacker can lure a logged-in victim to a crafted URL to execute reflected JavaScript or directly invoke public static methods accepting a single request array to delete synchronization state.


2) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose complete ACL-protected records without read permission.

The vulnerability exists due to missing authorization checks in Group Office's default JMAP export functionality when processing client-supplied record identifiers. A remote user can submit sequentially enumerated identifiers to an accessible module's export method and download the resulting blob to read records they cannot list or open.


3) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication and read, modify or delete LDAP users' calendars, address books and files through DAV.

The vulnerability exists due to improper authentication in the Group Office LDAP authenticator when empty passwords produce successful unauthenticated LDAP binds that are treated as valid logins. A remote attacker can submit a valid username and an empty password through HTTP Basic authentication over CalDAV, CardDAV or WebDAV, with "Force app passwords" disabled and an LDAP server permitting unauthenticated binds, to access the user's DAV data.


Remediation

Install update from vendor's website.

References