CVE-2026-63653 · Package
NO FIX YET · SEE WHAT TO DO
Group-Office's bookmark description action passes a user-supplied URL straight to its HTTP client with no host or IP checks. An authenticated user can make the server fetch internal addresses on their behalf (server-side request forgery).
first public Jul 2, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Group-Office installations before 26.0.37 with the bookmarks module in use are exposed. Any user who can call the bookmark description action can point the server at arbitrary URLs. Hosted or already-upgraded instances can skip it.
Not affected if bookmarks-module-disabled, patched-version
Who cares group-office, php, self-hosted
26.0.37 or later is patched.26.0.37 or later.Group-Office is an enterprise customer relationship management and groupware tool. Prior to version 26.0.37, go/modules/community/bookmarks/controller/Bookmark.php's description() action takes a fully attacker-controlled url parameter and passes it, unvalidated, to \GO\Base\Util\HttpClient::request(). HttpClient::_initRequest() sets CURLOPT_URL directly from this value with no host/IP validation at all. This can result in SSRF via Bookmark/description JMAP action. This issue has been patched in version 26.0.37.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.