7.1High
CVE-2026-27832Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator
Description
Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.8, 25.0.87, and 6.8.153 have a SQL Injection (SQLi) vulnerability, exploitable through the `advancedQueryData` parameter (`comparator` field) on an authenticated endpoint. The endpoint `index.php?r=email/template/emailSelection` processes `advancedQueryData` and forwards the SQL comparator without a strict allowlist into SQL condition building. This enables blind boolean-based exfiltration of the `core_auth_password` table. Versions 26.0.8, 25.0.87, and 6.8.153 fix the issue.
Weakness (CWE):
CWE-89
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| intermesh | group-office | < 6.8.153 | |
| Intermesh | groupoffice | < 6.8.153, >= 25.0.0, < 25.0.87, >= 26.0.0, < 26.0.8 |
References and patches
CPE matches (NVD) (3)
cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*< 6.8.153cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*≥ 25.0.1 < 25.0.87cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*≥ 26.0.1 < 26.0.8