Cross-site scripting in Group Office - CVE-2026-45551
Published: November 9, 2026
Vulnerability identifier: #VU162757
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-45551
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged authenticated attacker to execute stored JavaScript in an administrator's browser and escalate privileges in GroupOffice.
The vulnerability exists due to missing authorization for cross-user setting changes and unescaped insertion of email_font_size into the email module's JavaScript when the web client loads. A low-privileged authenticated attacker can store a malicious setting for an administrator, causing execution when that administrator opens the web interface and enabling promotion of the attacker's account to administrator.
Affected software
Group Office
How to mitigate CVE-2026-45551
Install security update from vendor's website.
Group Office - addressed in versions 6.8.165, 25.0.100, 26.0.25