Is CVE-2026-63653 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63653 being exploited in the wild.

How severe is CVE-2026-63653?

Medium severity, with a CVSS score of 5, published 10 November 2026.

Which products and versions are affected?

Intermesh Group-Office prior to 26.0.37.

Is there a fix for CVE-2026-63653?

Yes: fixed in 26.0.37. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63653 attacked?

It is attacked over the network.

Am I affected by CVE-2026-63653?

Check whether you run Intermesh Group-Office at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63653: Group-Office server-side request forgery in Bookmark description

CVE-2026-63653 · Severity: medium · CVSS 5 · Published 2026-11-10

Group-Office is an enterprise collaboration and CRM platform used by organizations for communication and data management. An authenticated user can trick the server into making HTTP requests to internal systems, cloud infrastructure endpoints, or the local machine itself, potentially exposing sensitive configuration data, credentials, or internal service responses that are reflected back in the application.

Technologies: Intermesh Group-Office. Vendors: Intermesh.

Quick answers

Is CVE-2026-63653 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63653 being exploited in the wild.
How severe is CVE-2026-63653?: Medium severity, with a CVSS score of 5, published 10 November 2026.
Which products and versions are affected?: Intermesh Group-Office prior to 26.0.37.
Is there a fix for CVE-2026-63653?: Yes: fixed in 26.0.37. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63653 attacked?: It is attacked over the network.
Am I affected by CVE-2026-63653?: Check whether you run Intermesh Group-Office at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 26.0.37

Technical details

The Bookmark module's description() action accepts an attacker-controlled URL parameter and passes it directly to HttpClient::request() with no validation of the hostname or IP address ranges. The server will issue requests to private RFC1918 ranges, loopback addresses, link-local addresses, and cloud metadata endpoints; the HTML response (title and meta tags) is parsed and returned to the authenticated user, enabling content leakage and reconnaissance. The vulnerability requires authentication but is reachable by any non-admin user since the bookmarks module auto-installs by default.

Affected products

Intermesh Group-Office prior to 26.0.37

Timeline

2026-07-02: disclosed
2026-06-30: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.