Missing Authorization in Group Office - #VU164349
Published: November 10, 2026
Vulnerability identifier: #VU164349
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose complete ACL-protected records without read permission.
The vulnerability exists due to missing authorization checks in Group Office's default JMAP export functionality when processing client-supplied record identifiers. A remote user can submit sequentially enumerated identifiers to an accessible module's export method and download the resulting blob to read records they cannot list or open.
Affected software
Group Office
Remediation
Install security update from vendor's website.
Group Office - addressed in versions 6.8.180, 25.0.115, 26.0.57