Intermesh groupoffice up to 6.8.155/25.0.89/26.0.11 AbstractSettingsCollection deserialization

Summaryinfo

A vulnerability identified as critical has been detected in Intermesh groupoffice up to 6.8.155/25.0.89/26.0.11. This issue affects some unknown processing of the component AbstractSettingsCollection. The manipulation leads to deserialization. This vulnerability is uniquely identified as CVE-2026-34838. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Intermesh groupoffice up to 6.8.155/25.0.89/26.0.11. This issue affects some unknown functionality of the component AbstractSettingsCollection. The manipulation with an unknown input leads to a deserialization vulnerability. Using CWE to declare the problem leads to CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.156, 25.0.90, and 26.0.12, a vulnerability in the AbstractSettingsCollection model leads to insecure deserialization when these settings are loaded. By injecting a serialized FileCookieJar object into a setting string, an authenticated attacker can achieve Arbitrary File Write, leading directly to Remote Code Execution (RCE) on the server. This issue has been patched in versions 6.8.156, 25.0.90, and 26.0.12.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-34838 since 03/30/2026. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 6.8.156, 25.0.90 or 26.0.12 eliminates this vulnerability. The upgrade is hosted for download at github.com.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Intermesh

Name

• groupoffice

Version

• 6.8.155
• 25.0.0
• 25.0.1
• 25.0.2
• 25.0.3
• 25.0.4
• 25.0.5
• 25.0.6
• 25.0.7
• 25.0.8
• 25.0.9
• 25.0.10
• 25.0.11
• 25.0.12
• 25.0.13
• 25.0.14
• 25.0.15
• 25.0.16
• 25.0.17
• 25.0.18
• 25.0.19
• 25.0.20
• 25.0.21
• 25.0.22
• 25.0.23
• 25.0.24
• 25.0.25
• 25.0.26
• 25.0.27
• 25.0.28
• 25.0.29
• 25.0.30
• 25.0.31
• 25.0.32
• 25.0.33
• 25.0.34
• 25.0.35
• 25.0.36
• 25.0.37
• 25.0.38
• 25.0.39
• 25.0.40
• 25.0.41
• 25.0.42
• 25.0.43
• 25.0.44
• 25.0.45
• 25.0.46
• 25.0.47
• 25.0.48
• 25.0.49
• 25.0.50
• 25.0.51
• 25.0.52
• 25.0.53
• 25.0.54
• 25.0.55
• 25.0.56
• 25.0.57
• 25.0.58
• 25.0.59
• 25.0.60
• 25.0.61
• 25.0.62
• 25.0.63
• 25.0.64
• 25.0.65
• 25.0.66
• 25.0.67
• 25.0.68
• 25.0.69
• 25.0.70
• 25.0.71
• 25.0.72
• 25.0.73
• 25.0.74
• 25.0.75
• 25.0.76
• 25.0.77
• 25.0.78
• 25.0.79
• 25.0.80
• 25.0.81
• 25.0.82
• 25.0.83
• 25.0.84
• 25.0.85
• 25.0.86
• 25.0.87
• 25.0.88
• 25.0.89
• 26.0.0
• 26.0.1
• 26.0.2
• 26.0.3
• 26.0.4
• 26.0.5
• 26.0.6
• 26.0.7
• 26.0.8
• 26.0.9
• 26.0.10
• 26.0.11

Website

• Product: https://github.com/Intermesh/groupoffice/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion