# CVE-2026-63653: Group-Office server-side request forgery in Bookmark description

Source: https://junglewise.ai/threats/cve-2026-63653-group-office-is-an-enterprise-customer-relationship-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-63653 · Severity: medium · CVSS 5 · Published 2026-11-10

Group-Office is an enterprise collaboration and CRM platform used by organizations for communication and data management. An authenticated user can trick the server into making HTTP requests to internal systems, cloud infrastructure endpoints, or the local machine itself, potentially exposing sensitive configuration data, credentials, or internal service responses that are reflected back in the application.

Technologies: [Intermesh Group-Office](https://junglewise.ai/threats/technologies/group-office). Vendors: [Intermesh](https://junglewise.ai/threats/vendors/intermesh).

## Quick answers

**Is CVE-2026-63653 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63653 being exploited in the wild.

**How severe is CVE-2026-63653?** Medium severity, with a CVSS score of 5, published 10 November 2026.

**Which products and versions are affected?** Intermesh Group-Office prior to 26.0.37.

**Is there a fix for CVE-2026-63653?** Yes: fixed in 26.0.37. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63653 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-63653?** Check whether you run Intermesh Group-Office at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 26.0.37

## Technical details

The Bookmark module's description() action accepts an attacker-controlled URL parameter and passes it directly to HttpClient::request() with no validation of the hostname or IP address ranges. The server will issue requests to private RFC1918 ranges, loopback addresses, link-local addresses, and cloud metadata endpoints; the HTML response (title and meta tags) is parsed and returned to the authenticated user, enabling content leakage and reconnaissance. The vulnerability requires authentication but is reachable by any non-admin user since the bookmarks module auto-installs by default.

## Affected products

- Intermesh Group-Office prior to 26.0.37

## Timeline

- 2026-07-02: disclosed
- 2026-06-30: patched

## References

- [https://github.com/Intermesh/groupoffice/releases/tag/v26.0.37](https://github.com/Intermesh/groupoffice/releases/tag/v26.0.37)
- [https://github.com/Intermesh/groupoffice/security/advisories/GHSA-3cp5-q6fp-mqf5](https://github.com/Intermesh/groupoffice/security/advisories/GHSA-3cp5-q6fp-mqf5)

## Related threats

- [Group-Office template injection in Contact/labels JMAP endpoint](https://junglewise.ai/threats/cve-2026-63011-group-office-is-an-enterprise-customer-relationship-management)
- [Group-Office stored XSS in reminders via HTML/JavaScript injection](https://junglewise.ai/threats/cve-2026-63010-group-office-is-an-enterprise-customer-relationship-management)
- [Group-Office arbitrary local file read in FolderController](https://junglewise.ai/threats/cve-2026-125390-group-office-before-6-8-181-25-0-116-and-26-0-58-contains-an)
- [Intermesh Group-Office stored XSS in email viewer](https://junglewise.ai/threats/cve-2026-125389-intermesh-group-office-before-6-8-181-25-0-116-and-26-0-58)
- [Intermesh Group-Office missing authorization in form report download](https://junglewise.ai/threats/cve-2026-125388-intermesh-group-office-before-6-8-181-25-0-116-and-26-0-58)