CVE-2026-27832 Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator
Authenticated attackers can exploit SQL injection in Group-Office to exfiltrate password hashes from the database.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-27832?
CVE-2026-27832 is a high-severity SQL injection vulnerability in Intermesh groupoffice, published on 27 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.8, 25.0.87, and 6.8.153 have a SQL Injection (SQLi) vulnerability, exploitable through the `advancedQueryData` parameter (`comparator` field) on an authenticated endpoint. The endpoint `index.php?r=email/template/emailSelection` processes `advancedQueryData` and forwards the SQL comparator without a strict allowlist into SQL condition building. This enables blind boolean-based exfiltration of the `core_auth_password` table. Versions 26.0.8, 25.0.87, and 6.8.153 fix the issue.
Weakness: CWE-89
Which versions are affected by CVE-2026-27832?
It affects 1 product.
Products include Intermesh Group-Office.
How do I fix CVE-2026-27832?
No fix has been published for CVE-2026-27832 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-27832 being exploited?
There is no known exploitation of CVE-2026-27832 in the wild and no public exploit code.
Other vulnerabilities in Intermesh groupoffice
- CVE-2026-34838 Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`
- CVE-2026-27947 Group-Office Vulnerable to Remote Code Execution (RCE)
- CVE-2026-33755 Authenticated SQL Injection in Contact/query addressBookIds filter
- CVE-2010-3428 SQL injection in n/a
- CVE-2025-48366 GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions
Sources
Also known as GHSA-vfgv-8w8v-qpxr.