{"id":"CVE-2026-63653","kind":"vulnerability","aliases":["CVE-2026-63653"],"related":[],"title":"Group-Office: bookmark description action lets users make server-side requests","description":"Group-Office is an enterprise customer relationship management and groupware tool. Prior to version 26.0.37, go/modules/community/bookmarks/controller/Bookmark.php's description() action takes a fully attacker-controlled url parameter and passes it, unvalidated, to \\GO\\Base\\Util\\HttpClient::request(). HttpClient::_initRequest() sets CURLOPT_URL directly from this value with no host/IP validation at all. This can result in SSRF via Bookmark/description JMAP action. This issue has been patched in version 26.0.37.","summary":"Group-Office's bookmark description action passes a user-supplied URL straight to its HTTP client with no host or IP checks. An authenticated user can make the server fetch internal addresses on their behalf (server-side request forgery).","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["group-office","package","php","self-hosted"],"not_affected_if":["bookmarks-module-disabled","patched-version"],"how_to_check":"- Check the installed Group-Office version; `26.0.37` or later is patched.\n- Confirm whether the bookmarks module is enabled in the installation.","fix":"- Group-Office: move to `26.0.37` or later.","status":"open","published_at":"2026-11-10T17:17:46+00:00","first_seen_at":"2026-11-10T17:22:44+00:00","triaged_at":"2026-11-10T17:24:38+00:00","updated_at":"2026-11-10T17:24:38+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T17:24:38Z","model":"claude-haiku-5-5","output":{"fix":"- Group-Office: move to `26.0.37` or later.","reach":"network","title":"Group-Office: bookmark description action lets users make server-side requests","impact":"medium","summary":"Group-Office's bookmark description action passes a user-supplied URL straight to its HTTP client with no host or IP checks. An authenticated user can make the server fetch internal addresses on their behalf (server-side request forgery).","audience":"businesses","category":"package","nicknames":[],"who_cares":["group-office","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"server reaches internal network addresses and returns their responses","analyst_note":"","how_to_check":"- Check the installed Group-Office version; `26.0.37` or later is patched.\n- Confirm whether the bookmarks module is enabled in the installation.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version","bookmarks-module-disabled"],"who_is_affected":"Group-Office installations before 26.0.37 with the bookmarks module in use are exposed. Any user who can call the bookmark description action can point the server at arbitrary URLs. Hosted or already-upgraded instances can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000698,"input_tokens":4655,"output_tokens":465,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-63653':16A,19A '26.0.37':85C,139C 'action':6A,34B,89C,131C 'address':61B 'attack':94C 'attacker-control':93C 'authent':53B 'base':104C 'behalf':64B 'bookmark':4A,32B 'bookmark/description':129C 'check':51B 'client':45B 'control':95C 'curlopt':111C 'custom':76C 'cve':14A,17A 'descript':5A,33B,88C 'direct':113C 'enterpris':75C 'fetch':59B 'forgeri':69B 'fulli':92C 'go':103C 'go/modules/community/bookmarks/controller/bookmark.php':86C 'group':2A,21B,29B,71C 'group-offic':1A,20B,28B,70C 'groupwar':80C 'host':27B,48B 'host/ip':119C 'http':44B 'httpclient':106C,108C 'initrequest':109C 'intern':60B 'ip':50B 'issu':133C 'jmap':130C 'let':7A 'make':9A,56B 'manag':78C 'offic':3A,22B,30B,72C 'packag':23B 'paramet':97C 'pass':35B,99C 'patch':136C 'php':24B 'prior':82C 'relationship':77C 'request':13A,68B,107C 'result':125C 'self':26B 'self-host':25B 'server':11A,58B,66B 'server-sid':10A,65B 'set':110C 'side':12A,67B 'ssrf':127C 'straight':41B 'suppli':39B 'take':90C 'tool':81C 'unvalid':101C 'url':40B,96C,112C 'user':8A,38B,54B 'user-suppli':37B 'util':105C 'valid':120C 'valu':116C 'version':84C,138C 'via':128C","nicknames":[],"mitigations":[],"who_affected":"Group-Office installations before 26.0.37 with the bookmarks module in use are exposed. Any user who can call the bookmark description action can point the server at arbitrary URLs. Hosted or already-upgraded instances can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["groupoffice","medium","package","php","selfhosted"],"campaign_type":null,"search_a":"'-2026':15A,18A '-63653':16A,19A 'action':6A 'bookmark':4A 'cve':14A,17A 'descript':5A 'group':2A 'group-offic':1A 'let':7A 'make':9A 'offic':3A 'request':13A 'server':11A 'server-sid':10A 'side':12A 'user':8A","search_b":"'action':34B 'address':61B 'authent':53B 'behalf':64B 'bookmark':32B 'check':51B 'client':45B 'descript':33B 'fetch':59B 'forgeri':69B 'group':21B,29B 'group-offic':20B,28B 'host':27B,48B 'http':44B 'intern':60B 'ip':50B 'make':56B 'offic':22B,30B 'packag':23B 'pass':35B 'php':24B 'request':68B 'self':26B 'self-host':25B 'server':58B,66B 'server-sid':65B 'side':67B 'straight':41B 'suppli':39B 'url':40B 'user':38B,54B 'user-suppli':37B","search_c":"'26.0.37':85C,139C 'action':89C,131C 'attack':94C 'attacker-control':93C 'base':104C 'bookmark/description':129C 'control':95C 'curlopt':111C 'custom':76C 'descript':88C 'direct':113C 'enterpris':75C 'fulli':92C 'go':103C 'go/modules/community/bookmarks/controller/bookmark.php':86C 'group':71C 'group-offic':70C 'groupwar':80C 'host/ip':119C 'httpclient':106C,108C 'initrequest':109C 'issu':133C 'jmap':130C 'manag':78C 'offic':72C 'paramet':97C 'pass':99C 'patch':136C 'prior':82C 'relationship':77C 'request':107C 'result':125C 'set':110C 'ssrf':127C 'take':90C 'tool':81C 'unvalid':101C 'url':96C,112C 'util':105C 'valid':120C 'valu':116C 'version':84C,138C 'via':128C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-02T06:46:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63653","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63653","severity":null,"published_at":"2026-11-10T17:17:46+00:00","modified_at":"2026-11-10T17:17:46+00:00","first_seen_at":"2026-11-10T17:22:44+00:00","fetched_at":"2026-11-10T17:22:44+00:00","note":null}],"documents":[{"id":116534,"url":"https://github.com/Intermesh/groupoffice/releases/tag/v26.0.37","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":116535,"url":"https://github.com/Intermesh/groupoffice/security/advisories/GHSA-3cp5-q6fp-mqf5","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-02T06:46:36+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}