CVE-2026-125388

EUVD-2026-120551
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every submission as an XLSX file, disclosing submissions they are not permitted to see.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 14.01%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
intermeshgroup-office
𝑥
< 6.8.181
CNA
intermeshgroup-office
25.0.0 ≤
𝑥
< 25.0.116
CNA
intermeshgroup-office
26.0.0 ≤
𝑥
< 26.0.58
CNA
Common Weakness Enumeration
References
https://github.com/Intermesh/groupoffice/blob/v26.0.57/www/api/download.php#L89-L129
https://github.com/Intermesh/groupoffice/security/advisories/GHSA-42qf-m3j9-837r
https://www.vulncheck.com/advisories/group-office-before-6.8.181-25.0.116-and-26.0.58-missing-authorization-in-forms-report-download
https://github.com/Intermesh/groupoffice/security/advisories/GHSA-42qf-m3j9-837r