CVE-2026-63011

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Contact/labels JMAP endpoint in GroupOffice accepts a fully attacker-controlled template string tpl parameter that is passed without restriction to...

CVE-2026-63653 Group-Office: SSRF via Bookmark/description JMAP action — server makes arbitrary HTTP(S) requests to user-controlled URL and reflects part of the response

Group-Office is an enterprise customer relationship management and groupware tool. Prior to version 26.0.37, go/modules/community/bookmarks/controller/Bookmark.php's description action takes a fully attacker-controlled url parameter and passes it, unvalidated, to \GO\Base\Util\HttpClient::request...

CVE-2026-63653

The Group-Office enterprise customer relationship management and groupware tool is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 26.0.37 . The vulnerability exists in the go/modules/community/bookmarks/controller/Bookmark.php file, where the description() action accepts a ...

EUVD-2026-121330

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Contact/labels JMAP endpoint in GroupOffice accepts a fully attacker-controlled template string tpl parameter that is passed without restriction to...

CVE-2026-63011

The Group-Office enterprise CRM and groupware tool is vulnerable to arbitrary OS command execution prior to versions 6.8.167, 25.0.102, and 26.0.27 . The vulnerability exists in the Contact/labels JMAP endpoint , which accepts an attacker-controlled tpl parameter passed to TemplateParser::parse()...

CVE-2026-63011 GroupOffice Vulnerable to RCE in TemplateParser eval() via Contact/labels

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Contact/labels JMAP endpoint in GroupOffice accepts a fully attacker-controlled template string tpl parameter that is passed without restriction to...

CVE-2026-63653: Intermesh groupoffice: Group-Office is an enterprise customer relationship management and groupware tool

Group-Office is an enterprise customer relationship management and groupware tool. Prior to version 26.0.37, go/modules/community/bookmarks/controller/Bookmark.php's description action takes a fully attacker-controlled url parameter and passes it, unvalidated, to \GO\Base\Util\HttpClient::request...

CVE-2026-63011: Intermesh groupoffice: Group-Office is an enterprise customer relationship management and groupware tool

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Contact/labels JMAP endpoint in GroupOffice accepts a fully attacker-controlled template string tpl parameter that is passed without restriction to...

CVE-2026-76171

In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses. Users are recommended to upgrade to version 3.9.1 which fixes this issue...

CVE-2026-49939

In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer folders in JMAP despite having being explicitly denied the right ...

EUVD-2026-118217

In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses. Users are recommended to upgrade to version 3.9.1 which fixes this issue...

CVE-2026-76171

Apache James server versions prior to 3.9.1 are vulnerable to a Server-Side Request Forgery (SSRF) . The flaw stems from improper validation in the JMAP webPush functionality, specifically allowing an attacker to reach internal addresses . Users are recommended to upgrade to version 3.9.1 to reso...

CVE-2026-76171 Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client

In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses. Users are recommended to upgrade to version 3.9.1 which fixes this issue...

CVE-2026-49939

In Apache James server versions prior to 3.9.1 , improper Access Control List (ACL) processing in the JMAP protocol allows for an authorization bypass. The vulnerability occurs because JMAP fails to account for negative rules defined by the IMAP protocol , enabling users to administer folders via...

CVE-2026-49939 Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol

In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer folders in JMAP despite having being explicitly denied the right ...

EUVD-2026-118216

In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer folders in JMAP despite having being explicitly denied the right ...

CVE-2026-49939: Apache Software Foundation Apache James: In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol…

In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer folders in JMAP despite having being explicitly denied the right ...

CVE-2026-76171: Apache Software Foundation Apache James: In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the…

In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses. Users are recommended to upgrade to version 3.9.1 which fixes this issue...

CVE-2026-113728 Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An...

CVE-2026-113728 Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An...