Improper Authentication in Group Office - #VU165863
Published: November 11, 2026
Vulnerability identifier: #VU165863
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication and read, modify or delete LDAP users' calendars, address books and files through DAV.
The vulnerability exists due to improper authentication in the Group Office LDAP authenticator when empty passwords produce successful unauthenticated LDAP binds that are treated as valid logins. A remote attacker can submit a valid username and an empty password through HTTP Basic authentication over CalDAV, CardDAV or WebDAV, with "Force app passwords" disabled and an LDAP server permitting unauthenticated binds, to access the user's DAV data.
Affected software
Group Office
Remediation
Install security update from vendor's website.
Group Office - addressed in versions 6.8.180, 25.0.115, 26.0.57