Technical impact
An authenticated user belonging to the System Administrator group can trigger a full server‑side request forgery via the WOPI service discovery URL. The vulnerability also allows direct reading of files on the host. The exploit path relies on the built‑in debug system to expose the SSRF response body, effectively turning the request into an exfiltration channel. This weakness falls under CWE‑918 and can lead to the disclosure of sensitive internal information and the compromise of file integrity.
Affected Systems
The flaw affects Intermesh Group‑Office installations with versions prior to 6.8.150, 25.0.82, and 26.0.5. All affected releases are listed on the Group‑Office product page and the CVE advisory. Systems running a later version are not impacted.
Risk and Exploitability
The CVSS v3.1 score of 8.2 reflects a high severity, and the EPSS score of less than 1% indicates a low but non‑zero likelihood of exploitation at present. The vulnerability is not included in the CISA KEV catalog, suggesting no known active exploitation. Attack execution requires authenticated access with System Administrator privileges; from there, an attacker can instruct the server to make requests to any internal host or port and read any file available to the process. Given the high impact and the need for privileged access, organizations should treat this as a critical patching priority.
