PT-2026-44827 · Intermesh · Group-Office

Published 2026-05-29 · Updated 2026-05-29 · CVE-2026-45551

Mitre

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Group-Office is an enterprise customer relationship management and groupware tool. Prior to 26.0.25, 25.0.100, and 6.8.165, GroupOffice allows authenticated users to persist arbitrary legacy settings for any user id via index.php?r=core/saveSetting. A separate client-side sink in the email module injects the email font size setting directly into JavaScript without escaping. By combining these two issues, any low-privileged authenticated user can overwrite an administrator's email font size setting with a JavaScript payload and trigger stored XSS in the administrator's browser when the GroupOffice web client loads views/Extjs3/modulescripts.php. This vulnerability is fixed in 26.0.25, 25.0.100, and 6.8.165.

Exploit

Fix

IDOR

XSS

Weakness Enumeration

CWE-639

CWE-79

Related Identifiers

CVE-2026-45551

Affected Products

Group-Office

References · 2

• 🔥 https://github.com/Intermesh/groupoffice/security/advisories/GHSA-9w92-p32g-g99p · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45551 · Security Note