Intermesh Group‑Office versions prior to 6.8.181, 25.0.116, and 26.0.58 have a missing authorization check that allows any authenticated user to invoke the api/download.php endpoint and download form reports. Because the script lacks permission validation, a user can request the business/forms/report blob with a form identifier and export all submissions as a single XLSX file, revealing sensitive data that should be protected by access controls. The flaw is classified as CWE‑862, Unauthorized Access.

Affected by this vulnerability are installations of Intermesh Group‑Office before version 6.8.181 (including all 25.0.x and 26.0.x releases below 25.0.116 and 26.0.58, respectively). Any deployment that has not yet been upgraded to at least 6.8.181, 25.0.116, or 26.0.58 is susceptible.

The CVSS score of 7.1 indicates a high severity risk. Although no EPSS score is available, the lack of mitigation in the source code combined with the authentication requirement means that an attacker who can log on to the system (or compromise existing credentials) can abuse the download endpoint to exfiltrate confidential submissions until access controls are patched. The vulnerability is not currently listed in the CISA KEV catalog, but its exposure allows a direct data export attack without additional exploitation steps.