CVE-2026-27832
Received Received - Intake

SQL Injection in Group-Office Email Template Enables Data Exfiltration

Publication date: 2026-02-27

Last updated on: 2026-03-04

Assigner: GitHub, Inc.

Description
Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.8, 25.0.87, and 6.8.153 have a SQL Injection (SQLi) vulnerability, exploitable through the `advancedQueryData` parameter (`comparator` field) on an authenticated endpoint. The endpoint `index.php?r=email/template/emailSelection` processes `advancedQueryData` and forwards the SQL comparator without a strict allowlist into SQL condition building. This enables blind boolean-based exfiltration of the `core_auth_password` table. Versions 26.0.8, 25.0.87, and 6.8.153 fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-27
Last Modified
2026-03-04
Generated
2026-07-26
AI Q&A
2026-02-27
EPSS Evaluated
2026-07-25
NVD
CVE-2026-27832
EUVD
EUVD-2026-9058

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
intermesh group-office From 25.0.1 (inc) to 25.0.87 (exc)
intermesh group-office to 6.8.153 (exc)
intermesh group-office From 26.0.1 (inc) to 26.0.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL Injection (SQLi) issue in Group-Office, an enterprise customer relationship management and groupware tool. It affects versions prior to 26.0.8, 25.0.87, and 6.8.153. The vulnerability occurs through the `advancedQueryData` parameter, specifically the `comparator` field, on an authenticated endpoint.

The endpoint `index.php?r=email/template/emailSelection` processes the `advancedQueryData` parameter and forwards the SQL comparator without a strict allowlist into SQL condition building. This improper handling allows an attacker to perform blind boolean-based exfiltration of the `core_auth_password` table.

The issue is fixed in versions 26.0.8, 25.0.87, and 6.8.153.

Detection Guidance

I don't know

Impact Analysis

This SQL Injection vulnerability can allow an attacker with authenticated access to extract sensitive information from the database, specifically from the `core_auth_password` table.

Such unauthorized data exfiltration can lead to credential compromise, unauthorized access, and potential further exploitation of the system.

Compliance Impact

I don't know

Mitigation Strategies

To mitigate this SQL Injection vulnerability in Group-Office, immediately upgrade your Group-Office installation to one of the fixed versions: 26.0.8, 25.0.87, or 6.8.153.

These versions address the issue by properly handling the `advancedQueryData` parameter and preventing unsafe SQL comparator usage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-27832. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart