Skip to content
OpenAdvisories

Product · Intermesh

groupoffice

22 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 8.7
    CVE-2026-63010

    Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.172, 25.0.108,…

    Intermesh groupoffice
  • High 8.8
    CVE-2026-33755

    Authenticated SQL Injection in Contact/query addressBookIds filter

    Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.158, 25.0.92, and 26.0.17, an authenticated SQL Injection vulnerability in the JMAP `Contact/query` endpoint allows any authenticated user with basic addr…

    Intermesh groupoffice
  • High 7.1
    CVE-2026-27832

    Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator

    Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.8, 25.0.87, and 6.8.153 have a SQL Injection (SQLi) vulnerability, exploitable through the `advancedQueryData` parameter (`comparator` field) on an authe…

    Intermesh groupoffice
  • High 8.2
    CVE-2026-25511

    Group-Office is vulnerable to SSRF and File Read in WOPI service discovery

    Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, an authenticated user within the System Administrator group can trigger a full SSRF via the WOPI service discovery URL, includin…

    Intermesh groupoffice
  • High 7.4
    CVE-2023-46730

    Server-Side Request Forgery in groupoffice

    Group-Office is an enterprise CRM and groupware tool. In affected versions there is full Server-Side Request Forgery (SSRF) vulnerability in the /api/upload.php endpoint. The /api/upload.php endpoint does not filter URLs which allows a malicious user to cause…

    Intermesh groupoffice