CVE-2026-125388 Group-Office before 6.8.181, 25.0.116, and 26.0.58 Missing Authorization in Forms Report Download
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-125388?
CVE-2026-125388 is a high-severity vulnerability in Intermesh Group-Office, published on 9 Nov 2026.
Official description
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every submission as an XLSX file, disclosing submissions they are not permitted to see.
Weakness: CWE-862
Which versions are affected by CVE-2026-125388?
How do I fix CVE-2026-125388?
No fix has been published for CVE-2026-125388 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-125388 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-125388 exists.
Sources
Also known as GHSA-42qf-m3j9-837r, GHSA-mp2v-gg3m-qvpx.