Missing Authorization in Intermesh Group-Office Form Report Downloads
CVE-2026-125388

7.1HIGH

Key Information:

Vendor

Intermesh

Status
Group-office
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125388?

Intermesh Group-Office versions prior to 6.8.181, 25.0.116, and 26.0.58 contain a significant vulnerability due to missing authorization checks in the API endpoint 'api/download.php'. This flaw allows authenticated users to bypass permission restrictions and download form submission reports, leading to potential data exposure. Attackers could exploit this vulnerability by requesting specific reports using the form ID, thereby accessing sensitive submissions that they do not have authorization to view.

Affected Version(s)

Group-Office 0 < 6.8.181

Group-Office 25.0.0 < 25.0.116

Group-Office 26.0.0 < 26.0.58

References

https://github.com/Intermesh/groupoffice/security/advisor...
vendor-advisory
https://github.com/Intermesh/groupoffice/blob/v26.0.57/ww...
technical-description
https://www.vulncheck.com/advisories/group-office-before-...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
.