Server-Side Request Forgery (SSRF) in Group Office - #VU162762
Published: November 9, 2026
Vulnerability identifier: #VU162762
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated user to make Group Office request internal services and disclose response content formatted as valid RSS/RDF XML.
The vulnerability exists due to incomplete blocking of IPv6 transition addresses in RSS feed URL validation when the server's network supports the corresponding transition routing. An authenticated user can subscribe to a feed using a NAT64, 6to4, or Teredo address targeting an internal service, bypassing the SSRF guard.
Affected software
Group Office
Remediation
Install security update from vendor's website.
Group Office - update to 26.0.42