CVE-2025-58576 Cross-site request forgery in GroupSession Free edition
Attackers can perform unintended operations on behalf of logged-in users via CSRF in GroupSession collaboration software.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-58576?
CVE-2025-58576 is a medium-severity vulnerability in Japan Total System Co.,Ltd. GroupSession Free edition, published on 12 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-site request forgery vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. If a user accesses a malicious page while logged in, unintended operations may be performed.
Weakness: CWE-352
Which versions are affected by CVE-2025-58576?
It affects 1 product.
Products include Groupsession Groupsession.
How do I fix CVE-2025-58576?
No fix has been published for CVE-2025-58576 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-58576 being exploited?
There is no known exploitation of CVE-2025-58576 in the wild and no public exploit code.
Other vulnerabilities in Japan Total System Co.,Ltd. GroupSession Free edition
- CVE-2021-20874 Missing authorization in GroupSession Free edition, GroupSession byCloud, GroupSession ZION
- CVE-2025-61987 Cross-site request forgery in GroupSession Free edition
- CVE-2021-20876 Path traversal in GroupSession Free edition, GroupSession byCloud, GroupSession ZION
- CVE-2017-2165 Information disclosure in GroupSession
- CVE-2021-20875 Open redirect in GroupSession Free edition, GroupSession byCloud, GroupSession ZION
Sources
Also known as GHSA-w2gc-6r6c-23j2.