CVE-2026-45551 | Intermesh groupoffice up to 6.8.164/25.0.1004/26.0.24 Email saveSetting email_font_size cross site scripting

GroupOffice contains a stored XSS vulnerability (CVE-2026-45551) in the Email Module's index.php?r=core/saveSetting that lets an authenticated low-privileged user persist an email_font_size value containing JavaScript which is injected into an administrator's browser; the advisory documents technical details, confirms remote exploitation requiring victim interaction, reports no public exploit, and recommends upgrading to versions 6.8.165, 25.0.1005, or 26.0.25 to remediate.