Description
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every submission as an XLSX file, disclosing submissions they are not permitted to see.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Intermesh | Group-Office | < 6.8.181, 25.0.0 – < 25.0.116, 26.0.0 – < 26.0.58 | 6.8.181 |
References
- GitHub Security Advisory (GHSA-42qf-m3j9-837r) vendor-advisory
- https://github.com/Intermesh/groupoffice/blob/v26.0.57/www/api/download.php#L89-L129 technical-description
- VulnCheck Advisory: Group-Office before 6.8.181, 25.0.116, and 26.0.58 Missing Authorization in Forms Report Download third-party-advisory