CVE-2026-27823 Remote Code Execution Vulnerability in EGroupware
Authenticated attackers can achieve remote code execution via improper authorization and file primitives, potentially allowing unauthenticated access if self-registration is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27823?
CVE-2026-27823 is a high-severity vulnerability in egroupware, published on 20 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability has been identified in EGroupware that may lead to Remote Code Execution (RCE). The issue allows an authenticated attacker to execute arbitrary commands on the server. If user self-registration is enabled, the vulnerability may be exploitable without prior authentication. The vulnerability stems from improper authorization checks combined with a file write primitive and an arbitrary file read vulnerability, which together enable full system compromise. This has been patched in versions 26.2.20260224 and 23.1.20260224.
Weakness: CWE-285
Which versions are affected by CVE-2026-27823?
4 open source packages ship an affected version, including egroupware/egroupware.
| Package | Affected | Fixed in |
|---|---|---|
egroupware/egroupware Packagist | All versions | 23.1.20260224 |
egroupware/egroupware Packagist | All versions | 23.1.20260224 |
egroupware/egroupware Packagist | From 26.0.20251208 | 26.2.20260224 |
egroupware/egroupware Packagist | From 26.0.20251208 | 26.2.20260224 |
How do I fix CVE-2026-27823?
Upgrade egroupware/egroupware to a fixed version for your release line: 23.1.20260224 or 26.2.20260224.
Is CVE-2026-27823 being exploited?
There is no known exploitation of CVE-2026-27823 in the wild and no public exploit code.
Sources
Also known as GHSA-h9qx-v5xp-ph8p.