CVE-2026-63011

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Contact/labels JMAP endpoint in GroupOffice accepts a fully attacker-controlled template string tpl parameter that is passed without restriction to...

EUVD-2026-121330

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Contact/labels JMAP endpoint in GroupOffice accepts a fully attacker-controlled template string tpl parameter that is passed without restriction to...

CVE-2026-63011: Intermesh groupoffice: Group-Office is an enterprise customer relationship management and groupware tool

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Contact/labels JMAP endpoint in GroupOffice accepts a fully attacker-controlled template string tpl parameter that is passed without restriction to...

PT-2026-141853

Name of the Vulnerable Software and Affected Versions Group-Office versions prior to 6.8.167 Group-Office versions prior to 25.0.102 Group-Office versions prior to 26.0.27 Description An authenticated user can execute arbitrary operating system commands as the web server user www-data via a singl...