Email Triage
MCP Workflows
Slack Bot
Description
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every submission as an XLSX file, disclosing submissions they are not permitted to see.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Intermesh Group-Office
Default version status: unaffected
0 to < 6.8.181affected25.0.0 to < 25.0.116affected26.0.0 to < 26.0.58affected
pkg:github/Intermesh/groupofficeReferences
- https://github.com/Intermesh/groupoffice/security/advisories/GHSA-42qf-m3j9-837r ↗
- https://github.com/Intermesh/groupoffice/blob/v26.0.57/www/api/download.php#L89-L129 ↗
- https://www.vulncheck.com/advisories/group-office-before-6.8.181-25.0.116-and-26.0.58-missing-authorization-in-forms-report-download ↗