EUVD-2026-33290Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Group-Office is an enterprise customer relationship management and groupware tool. Prior to 26.0.25, 25.0.100, and 6.8.165, GroupOffice allows authenticated users to persist arbitrary legacy settings for any user_id via index.php?r=core/saveSetting. A separate client-side sink in the email module injects the email_font_size setting directly into JavaScript without escaping. By combining these two issues, any low-privileged authenticated user can overwrite an administrator's email_font_size setting with a JavaScript payload and trigger stored XSS in the administrator's browser when the GroupOffice web client loads views/Extjs3/modulescripts.php. This vulnerability is fixed in 26.0.25, 25.0.100, and 6.8.165.
AnalysisAI
Stored XSS privilege escalation in Group-Office (enterprise CRM/groupware by Intermesh) allows any low-privileged authenticated user to execute arbitrary JavaScript in an administrator's browser by chaining two distinct flaws. The attack exploits a missing ownership check on the legacy settings API (index.php?r=core/saveSetting) - permitting writes to any user's settings regardless of identity - combined with an unsafe JavaScript sink in the email module that injects the email_font_size setting directly into rendered script without sanitization. No confirmed active exploitation exists (not in CISA KEV), but SSVC confirms a proof-of-concept exists, making this a credible privilege-escalation path for any attacker with a low-privileged account.
Technical ContextAI
Group-Office is a PHP-based enterprise CRM and groupware platform (CPE: cpe:2.3:a:intermesh:groupoffice). The vulnerability chain involves two distinct weaknesses rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation). First, the legacy settings persistence endpoint index.php?r=core/saveSetting performs no ownership or authorization check on the user_id parameter, allowing any authenticated user to overwrite settings belonging to arbitrary accounts - a classic IDOR pattern. Second, the email module's front-end rendering code in views/Extjs3/modulescripts.php interpolates the stored email_font_size setting value directly into a JavaScript context without HTML or JavaScript escaping. The use of 'legacy settings' terminology in the advisory suggests this sink predates modern output-encoding practices in the codebase. The attack is delivered over the network (AV:N), requires no special attack conditions (AT:N in CVSS 4.0), and exploits passive user interaction when the administrator's browser loads the email module scripts during normal application use (UI:P).
RemediationAI
Upgrade Group-Office to 26.0.25 (26.0.x branch), 25.0.100 or 25.0.1005 - verify the exact fix version for the 25.0.x branch in advisory GHSA-9w92-p32g-g99p - or 6.8.165 (6.8.x branch), as confirmed by the vendor via https://github.com/Intermesh/groupoffice/security/advisories/GHSA-9w92-p32g-g99p. If immediate patching is not feasible, the most targeted compensating control is to block or restrict POST requests to index.php?r=core/saveSetting at the WAF or reverse proxy layer for non-administrative roles; this severs the first link in the attack chain by preventing unauthorized settings writes. Note that this control may break legitimate user preferences functionality if low-privileged users need to save their own settings, so a more precise rule restricting the user_id parameter to the authenticated session's own ID may be preferable but requires application-aware filtering. Additionally, restricting Group-Office access to trusted internal networks reduces exposure to untrusted authenticated users who could otherwise exploit this chain.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today