CVE-2026-25511

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, an authenticated user within the System Administrator group can trigger a full SSRF via the WOPI service discovery URL, including access to internal hosts/ports. The SSRF response body can be exfiltrated via the built‑in debug system, turning it into a visible SSRF. This also allows full server-side file read. This issue has been patched in versions 6.8.150, 25.0.82, and 26.0.5.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Intermesh/groupoffice/commit/5ac199dce758e1ce0d1cdb6905df5da3c2af42b3	Patch
https://github.com/Intermesh/groupoffice/security/advisories/GHSA-r9v4-jm2r-r9pm	Exploit Vendor Advisory
https://github.com/Intermesh/groupoffice/security/advisories/GHSA-r9v4-jm2r-r9pm	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:group-office:group_office::::::::
	cpe:2.3:a:group-office:group_office::::::::
	cpe:2.3:a:group-office:group_office::::::::

History

No history.

Information

Published : 2026-02-04 21:16

Updated : 2026-06-17 10:24

NVD link : CVE-2026-25511

Mitre link : CVE-2026-25511

CVE.ORG link : CVE-2026-25511

JSON object : View

Products Affected

group-office

group_office

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-25511", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25511", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-05T21:02:18.815073Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Intermesh", "product": "groupoffice", "versions": [{"status": "affected", "version": "< 6.8.150"}, {"status": "affected", "version": "< 25.0.82"}, {"status": "affected", "version": "< 26.0.5"}]}]}], "published": "2026-02-04T21:16:02.243", "references": [{"url": "https://github.com/Intermesh/groupoffice/commit/5ac199dce758e1ce0d1cdb6905df5da3c2af42b3", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Intermesh/groupoffice/security/advisories/GHSA-r9v4-jm2r-r9pm", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Intermesh/groupoffice/security/advisories/GHSA-r9v4-jm2r-r9pm", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, an authenticated user within the System Administrator group can trigger a full SSRF via the WOPI service discovery URL, including access to internal hosts/ports. The SSRF response body can be exfiltrated via the built\u2011in debug system, turning it into a visible SSRF. This also allows full server-side file read. This issue has been patched in versions 6.8.150, 25.0.82, and 26.0.5."}, {"lang": "es", "value": "Group-Office es una herramienta de gesti\u00f3n de relaciones con clientes empresariales y de groupware. Antes de las versiones 6.8.150, 25.0.82 y 26.0.5, un usuario autenticado dentro del grupo de Administradores del Sistema puede desencadenar un SSRF completo a trav\u00e9s de la URL de descubrimiento de servicio WOPI, incluyendo acceso a hosts/puertos internos. El cuerpo de la respuesta SSRF puede ser exfiltrado a trav\u00e9s del sistema de depuraci\u00f3n incorporado, convirti\u00e9ndolo en un SSRF visible. Esto tambi\u00e9n permite la lectura completa de archivos del lado del servidor. Este problema ha sido parcheado en las versiones 6.8.150, 25.0.82 y 26.0.5."}], "lastModified": "2026-06-17T10:24:46.020", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:group-office:group_office:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F54FF3F-BE7C-41FF-926A-9496CE99CE97", "versionEndExcluding": "6.8.150", "versionStartIncluding": "6.8.0"}, {"criteria": "cpe:2.3:a:group-office:group_office:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39BE8337-170B-4895-A5AA-B27AFB64E418", "versionEndExcluding": "25.0.82", "versionStartIncluding": "25.0.1"}, {"criteria": "cpe:2.3:a:group-office:group_office:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB489F3F-5EA4-4DFD-9F70-9AD862D7401A", "versionEndExcluding": "26.0.5", "versionStartIncluding": "26.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}