Authorization bypass through user-controlled key in Group Office - #VU164346
Published: November 10, 2026
Vulnerability identifier: #VU164346
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose other users' file metadata, including names, full paths, sizes, ownership and timestamps, but not file contents.
The vulnerability exists due to authorization bypass through user-controlled keys in Group Office's files/file/open action when resolving file paths or identifiers with ACL enforcement disabled and returning attributes without checking permissions. A remote user can submit another user's file path or identifier through the Files module to retrieve metadata without authorization.
Affected software
Group Office
Remediation
Install security update from vendor's website.
Group Office - addressed in versions 6.8.181, 26.0.58