CVE-2026-63653

Name of the Vulnerable Software and Affected Versions Group-Office versions prior to 26.0.37

Description The description() action in go/modules/community/bookmarks/controller/Bookmark.php accepts a user-controlled url parameter and passes it without validation to the GOBaseUtilHttpClient::request() function. Subsequently, the HttpClient:: initRequest() function assigns this value to CURLOPT URL without performing host or IP validation. This flaw allows Server-Side Request Forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location, via the Bookmark/description JMAP action.

Recommendations Update to version 26.0.37.