Is CVE-2026-125388 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-125388 being exploited in the wild.

How severe is CVE-2026-125388?

Medium severity, with a CVSS score of 6.5, published 10 November 2026.

Which products and versions are affected?

Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58.

Is there a fix for CVE-2026-125388?

Yes: fixed in 6.8.181, 25.0.116, 26.0.58. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-125388 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-125388?

Check whether you run Intermesh Group-Office at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125388: Intermesh Group-Office missing authorization in form report download

CVE-2026-125388 · Severity: medium · CVSS 6.5 · Published 2026-11-10

Group-Office is a collaborative office suite that manages business applications including form submissions. The vulnerability allows any authenticated user to download and export all form submissions as XLSX files, even if they lack permission to access the forms module, exposing sensitive personal information like names, emails, and free-text answers from all submissions across all forms.

Technologies: Intermesh Group-Office. Vendors: Intermesh.

Quick answers

Is CVE-2026-125388 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-125388 being exploited in the wild.
How severe is CVE-2026-125388?: Medium severity, with a CVSS score of 6.5, published 10 November 2026.
Which products and versions are affected?: Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58.
Is there a fix for CVE-2026-125388?: Yes: fixed in 6.8.181, 25.0.116, 26.0.58. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-125388 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-125388?: Check whether you run Intermesh Group-Office at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.8.181, 25.0.116, 26.0.58

Technical details

The business/forms module's downloadReport handler in api/download.php lacks authorization checks, unlike sibling modules (finance, projects3, calendar) that explicitly verify permissions. An authenticated attacker can call the endpoint with blob=business/forms/report/<formId> to retrieve complete form submissions; the Entity::findById() ORM call applies no ACL, and sequential form ID enumeration allows exhaustive data disclosure. Attack requires only authentication (no module access needed) and network access to the API.

Affected products

Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58

Timeline

2026-11-10: disclosed: Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.