Server-Side Request Forgery (SSRF) in Group Office - #VU162763
Published: November 9, 2026
Vulnerability identifier: #VU162763
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a highly privileged attacker to probe loopback or internal HTTP services through the Group Office server.
The vulnerability exists due to missing destination safety checks in WOPI discovery when users with WOPI configuration permissions save or update service URLs. A highly privileged attacker can supply an internal destination to trigger a server-side request to /hosting/discovery and use discovery success or failure as a probing signal.
Affected software
Group Office
Remediation
Install security update from vendor's website.
Group Office - update to 26.0.52