CVE-2026-125388: Group-Office before 6.8.181, 25.0.116, and 26.0.58 Missing Authorization in Forms Report Download
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every submission as an XLSX file, disclosing submissions they are not permitted to see.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Group-Office user can exploit it. The attacker does not need permission to view the targeted form submissions.
What access or request is needed to retrieve data?
An attacker needs an authenticated session and must request the business/forms/report blob through api/download.php with a form ID. Successful exploitation exports every submission for that form as an XLSX file.
Which versions should be remediated?
Update Group-Office to 6.8.181, 25.0.116, or 26.0.58 or later, depending on the release branch in use. Earlier versions in those branches are affected.
How can an organization assess possible exposure?
Review access and application logs for authenticated requests to api/download.php involving the business/forms/report blob and form IDs. Treat unexpected XLSX report exports, especially by users without form-view permissions, as potential unauthorized disclosure.