SSRF Vulnerability in Group-Office by Intermesh
CVE-2026-63653

5MEDIUM

Key Information:

Vendor

Intermesh

Status
Groupoffice
Vendor
CVE Published:
10 November 2026

What is CVE-2026-63653?

Group-Office, an enterprise customer relationship management and groupware tool, has a vulnerability in its Bookmark module. Prior to version 26.0.37, the description() action of the bookmarks controller allowed an attacker to send a maliciously crafted URL parameter directly. This parameter was used without any validation in the HttpClient request, posing a risk of Server-Side Request Forgery (SSRF). By exploiting this flaw, an attacker could potentially send requests to internal servers, thus compromising the security of the system. This vulnerability has been addressed in the updated version 26.0.37 with appropriate patches.

Affected Version(s)

groupoffice < 26.0.37

References

https://github.com/Intermesh/groupoffice/security/advisor...
x_refsource_CONFIRM
https://github.com/Intermesh/groupoffice/releases/tag/v26...
x_refsource_MISC

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.