CVE-2026-125388

Name of the Vulnerable Software and Affected Versions Intermesh Group-Office versions prior to 6.8.181 Intermesh Group-Office versions prior to 25.0.116 Intermesh Group-Office versions prior to 26.0.58

Description Authenticated users can download form reports without proper permission checks. By requesting the business/forms/report blob using a specific form ID via the 'api/download.php' endpoint, an attacker can export all submissions as an XLSX file, leading to the disclosure of unauthorized data.

Recommendations Update to version 6.8.181 or later. Update to version 25.0.116 or later. Update to version 26.0.58 or later. Restrict access to the 'api/download.php' endpoint to minimize the risk of unauthorized data export.