PT-2026-141211

CVE-2026-125388

·

Published

2026-11-09

·

Updated

2026-11-10

Description by

CVSS 3.1
6.5
Medium
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every submission as an XLSX file, disclosing submissions they are not permitted to see.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-862: Missing Authorization
Related identifiers
CVE-2026-125388
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com