CVE-2026-45551 Intermesh CVE debrief

Who should care

Organizations running GroupOffice CRM/groupware deployments with multiple user privilege levels, particularly those with external or low-trust user accounts. Security teams responsible for web application security in enterprise collaboration environments. Administrators of GroupOffice instances prior to the patched versions.

Technical summary

The vulnerability chain begins with an authorization bypass in the core settings save functionality (index.php?r=core/saveSetting), which fails to validate that the authenticated user is authorized to modify settings for the specified target user_id. This allows any authenticated user to overwrite settings belonging to other users, including administrators. The second component is a DOM-based XSS sink in the email module where the email_font_size configuration value is interpolated into JavaScript source code without proper escaping or sanitization. An attacker with any valid account can set an administrator's email_font_size to a payload such as a JavaScript string terminator followed by arbitrary script content. When the administrator subsequently loads the GroupOffice interface and the modulescripts.php resource is requested, the poisoned setting is retrieved and embedded into the response, causing execution in the administrator's browser session. The attack requires user interaction (administrator login and page load) but grants script execution in the privileged context of the targeted administrator account.

Defensive priority

medium

Recommended defensive actions

• Upgrade GroupOffice to version 26.0.25, 25.0.100, or 6.8.165 or later to remediate this vulnerability
• Review and implement principle of least privilege for settings modification endpoints
• Audit user settings for unexpected or malicious values, particularly email_font_size configurations
• Implement output encoding for all user-controlled values injected into JavaScript contexts
• Consider additional input validation on the saveSetting endpoint to prevent cross-user setting modification

Evidence notes

Vulnerability description confirms authenticated attack vector requiring low privileges. CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, and user interaction required. CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-639 (Authorization Bypass Through User-Controlled Key) identified as applicable weaknesses.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.