---
id: "CVE-2026-63653"
page: "https://infrastack.ai/live/CVE-2026-63653"
kind: "vulnerability"
aliases: ["CVE-2026-63653"]
title: "Group-Office: bookmark description action lets users make server-side requests"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["group-office", "package", "php", "self-hosted"]
not_affected_if: ["bookmarks-module-disabled", "patched-version"]
published_at: "2026-11-10T17:17:46+00:00"
first_seen_at: "2026-11-10T17:22:44+00:00"
updated_at: "2026-11-10T17:24:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63653", "first_seen_at": "2026-11-10T17:22:44+00:00"}]
exploit_sources: []
---

# Group-Office: bookmark description action lets users make server-side requests

Link for people: https://infrastack.ai/live/CVE-2026-63653 (this .md is for agents)

Group-Office's bookmark description action passes a user-supplied URL straight to its HTTP client with no host or IP checks. An authenticated user can make the server fetch internal addresses on their behalf (server-side request forgery).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Group-Office version; `26.0.37` or later is patched.
- Confirm whether the bookmarks module is enabled in the installation.

## Fix

- Group-Office: move to `26.0.37` or later.

## Timeline

- 2026-11-10T17:22:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63653

## Documents

- [advisory] Vendor advisory: github.com https://github.com/Intermesh/groupoffice/security/advisories/GHSA-3cp5-q6fp-mqf5
- [fix] Release notes: github.com https://github.com/Intermesh/groupoffice/releases/tag/v26.0.37

## From the sources

Group-Office is an enterprise customer relationship management and groupware tool. Prior to version 26.0.37, go/modules/community/bookmarks/controller/Bookmark.php's description() action takes a fully attacker-controlled url parameter and passes it, unvalidated, to \GO\Base\Util\HttpClient::request(). HttpClient::_initRequest() sets CURLOPT_URL directly from this value with no host/IP validation at all. This can result in SSRF via Bookmark/description JMAP action. This issue has been patched in version 26.0.37.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_