GHSA-42qf-m3j9-837r: Group-Office before 6.8.181, 25.0.116, and 26.0.58 Missing Authorization in Forms Report Download
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every submission as an XLSX file, disclosing submissions they are not permitted to see.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Group-Office user may be able to exploit it. The attacker needs a valid account and a form ID; no additional permission to view the form submissions is checked in the affected download path.
What information can be exposed?
An attacker can request the business/forms/report blob and export every submission for the targeted form as an XLSX file. This can disclose form submissions that the authenticated user is not authorized to view.
Which releases are affected?
The issue affects Group-Office releases before 6.8.181, 25.0.116, and 26.0.58. Upgrading to at least the applicable listed release addresses the affected versions.
How can administrators determine whether they may have been affected?
Review access and download activity involving api/download.php requests for the business/forms/report blob, especially requests that export XLSX reports for form IDs by users without permission to view those submissions. The provided information does not identify a specific log format or indicator beyond this request behavior.