CVE-2026-45551
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
In Group-Office prior to versions 26.0.25, 25.0.100, and 6.8.165, authenticated users can persist arbitrary legacy settings for any user_id. A separate issue in the email module injects the email_font_size setting directly into JavaScript without escaping. A low-privileged user can overwrite an administrator's email_font_size setting with a JavaScript payload and trigger stored XSS in the administrator's browser.
Risk Assessment
Stored XSS could allow an attacker to hijack an administrator's session, steal data, or perform unauthorized actions in the administrator's context.
Recommendation
Update Group-Office to version 26.0.25, 25.0.100, or 6.8.165.
Other vulnerabilities in Group-Office
See all- CVE-2026-34838Critical
Group-Office prior to versions 6.8.156, 25.0.90, and 26.0.12 has a vulnerability in the AbstractSettingsCollection model leading to insecure deserialization, allowing arbitrary file write and remote code execution.
- CVE-2023-25292Medium
A reflected Cross Site Scripting (XSS) vulnerability was found in Intermesh BV Group-Office version 6.6.145. Attackers can exploit the GO_LANGUAGE cookie to escalate privileges and obtain sensitive information.
Original NVD description (English source)
Group-Office is an enterprise customer relationship management and groupware tool. Prior to 26.0.25, 25.0.100, and 6.8.165, GroupOffice allows authenticated users to persist arbitrary legacy settings for any user_id via index.php?r=core/saveSetting. A separate client-side sink in the email module injects the email_font_size setting directly into JavaScript without escaping. By combining these two issues, any low-privileged authenticated user can overwrite an administrator's email_font_size setting with a JavaScript payload and trigger stored XSS in the administrator's browser when the GroupOffice web client loads views/Extjs3/modulescripts.php. This vulnerability is fixed in 26.0.25, 25.0.100, and 6.8.165.