CVE-2026-30237

Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)

Published Mar 6, 2026 CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Description

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in the GroupOffice installer, endpoint install/license.php. The POST field license is rendered without escaping inside a <textarea>, allowing a </textarea><script>...</script> breakout.. This issue has been patched in versions 6.8.155, 25.0.88, and 26.0.10.

Analysis

Technical impact

A reflected XSS flaw exists in the installer license page of GroupOffice, where a POST variable is inserted into a textarea without escaping, permitting a CDATA break and arbitrary script execution. The vulnerability can be used to run malicious scripts in the browser of anyone who views the license page, potentially stealing session cookies or executing other client‑side attacks.

Affected Systems

Intermesh GroupOffice versions earlier than 6.8.155, 25.0.88, and 26.0.10 are affected. The flaw resides in the install/license.php endpoint used during installation.

Risk and Exploitability

The CVSS score of 2.1 indicates low severity, and the EPSS score of less than 1 % reflects a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to reach the installer page, which normally exists only on a freshly provisioned server; therefore the attack surface is limited. Despite the low risk, the flaw permits user‑containing script injection and should be remediated promptly.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Intermesh

groupoffice

affected

Version	Status	Constraints
`< 6.8.155`	affected	—
`< 25.0.88`	affected	—
`< 26.0.10`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:intermesh:group-office::::::::
	cpe:2.3:a:intermesh:group-office::::::::
	cpe:2.3:a:intermesh:group-office::::::::

No data.

Vendor Product Versions

Intermesh

Group-office

Version	Status	Scheme	Platform
`[0,6.8.155)`	affected	semver	—
`[0,25.0.88)`	affected	semver	—
`[0,26.0.10)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade GroupOffice to version 6.8.155, 25.0.88, or 26.0.10 or newer.
Remove or restrict access to the installer pages in a production environment.
Add server‑side input validation to the license parameter to escape or strip HTML before rendering.

Generated by OpenCVE AI on April 16, 2026 at 11:09 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction Active

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.262% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/Intermesh/groupoffice/security/advisories/GHSA-hchr-32xh-x5rx

History

Mar 11, 2026 1:45 PM Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:intermesh:group-office::::::::
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`

Mar 9, 2026 9:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 9, 2026 10:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Intermesh Intermesh group-office
Vendors & Products		Intermesh Intermesh group-office

Mar 6, 2026 9:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is a reflected XSS vulnerability in the GroupOffice installer, endpoint install/license.php. The POST field license is rendered without escaping inside a <textarea>, allowing a </textarea><script>...</script> breakout.. This issue has been patched in versions 6.8.155, 25.0.88, and 26.0.10.
Title		Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php)
Weaknesses		CWE-79
References		https://github.com/Intermesh/groupoffice/security/advisories/GHSA-hchr-32xh-x5rx
Metrics		cvssV4_0 `{'score': 2.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}`