What is the CVSS score of CVE-2026-25511?

CVE-2026-25511 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Group Office are affected by CVE-2026-25511?

Organizations using Group-Office should be aware of moderate risk from CVE-2026-25511, a server-side request forgery vulnerability rated CVSS 4.9.. A patch is available.

Is there a public PoC exploit available for CVE-2026-25511?

Yes, a public proof-of-concept exploit is available for CVE-2026-25511. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25511?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Group Office CVE-2026-25511

MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-02-04 security-advisories@github.com

SSRF Group Office

4.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 11, 2026 - 19:16 vuln.today

Public exploit code

Patch released

Feb 11, 2026 - 19:16 nvd

Patch available

CVE Published

Feb 04, 2026 - 21:16 nvd

MEDIUM 4.9

DescriptionGitHub Advisory

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, an authenticated user within the System Administrator group can trigger a full SSRF via the WOPI service discovery URL, including access to internal hosts/ports. The SSRF response body can be exfiltrated via the built‑in debug system, turning it into a visible SSRF. This also allows full server-side file read. This issue has been patched in versions 6.8.150, 25.0.82, and 26.0.5.

AnalysisAI

Server-side request forgery in Group Office's WOPI service discovery allows authenticated System Administrators to access internal hosts, ports, and files on the affected server. The vulnerability enables attackers to exfiltrate SSRF response bodies through the debug system, effectively converting a blind SSRF into a visible information disclosure attack. Public exploit code exists for this medium-severity flaw, which has been patched in versions 6.8.150, 25.0.82, and 26.0.5.

Technical ContextAI

Classified as CWE-918 (Server-Side Request Forgery (SSRF)). Affects the WOPI component of Group Office. Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, an authenticated user within the System Administrator group can trigger a full SSRF via the WOPI service discovery URL, including access to internal hosts/ports. The SSRF response body can be exfiltrated via the built‑in debug system, turning it into a visible SSRF. This also allows full server-side file read. This issue has been patched in versions 6.8.150, 25.0.82,