PT-2026-44827 · Unknown · Group-Office

Diblei · CVE-2026-45551 · Published 2026-05-29 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions GroupOffice versions prior to 26.0.25 GroupOffice versions prior to 25.0.100 GroupOffice versions prior to 6.8.165

Description GroupOffice allows authenticated users to persist arbitrary legacy settings for any user id through the 'index.php?r=core/saveSetting' endpoint. A client-side sink in the email module injects the email font size setting directly into JavaScript without escaping. A low-privileged authenticated user can exploit these issues by overwriting an administrator's email font size setting with a JavaScript payload, triggering stored Cross-Site Scripting (XSS)—a technique where malicious scripts are permanently stored on the target server—in the administrator's browser when the web client loads 'views/Extjs3/modulescripts.php'.

Recommendations Update to version 26.0.25. Update to version 25.0.100. Update to version 6.8.165.

Exploit

Fix

XSS

IDOR

Weakness Enumeration

CWE-79

CWE-639

Related Identifiers

CVE-2026-45551

GHSA-9W92-P32G-G99P

Affected Products

Group-Office

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45551.json · Exploit
• 🔥 https://github.com/Intermesh/groupoffice/security/advisories/GHSA-9w92-p32g-g99p · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45551 · Security Note
• https://osv.dev/vulnerability/CVE-2026-45551 · Vendor Advisory
• https://t.me/cveNotify/208768 · Telegram Post
• https://t.me/CVEtracker/55249 · Telegram Post