CVE-2026-125388 · Other
NO FIX YET · SEE WHAT TO DO
Group-Office, a business collaboration suite, lets any logged-in user download form reports through api/download.php without permission checks. An attacker can export every form submission as an XLSX file, including submissions they are not allowed to see.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any Group-Office installation where users have accounts can be exposed, because the flaw needs only an authenticated session and a form ID. Instances with no forms in use, or that are not reachable by users who should not see form data, carry less risk. unknown whether the sources describe a non-default setting.
Not affected if unauthenticated-only-access
Who cares forms, group-office, self-hosted
api/download.php endpoint on your Group-Office server.6.8.181 is affected; move to 6.8.181 or later on the 6.8 line.25.0.116 is affected; move to 25.0.116 or later on the 25.0 line.26.0.58 is affected; move to or later on the 26.0 line.Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every submission as an XLSX file, disclosing submissions they are not permitted to see.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
26.0.58