CVE-2026-27832: Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator
Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.8, 25.0.87, and 6.8.153 have a SQL Injection (SQLi) vulnerability, exploitable through the advancedQueryData parameter (comparator field) on an authenticated endpoint. The endpoint index.php?r=email/template/emailSelection processes advancedQueryData and forwards the SQL comparator without a strict allowlist into SQL condition building. This enables blind boolean-based exfiltration of the coreauthpassword table. Versions 26.0.8, 25.0.87, and 6.8.153 fix the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27832?
The severity of CVE-2026-27832 is classified as high due to its potential for authenticated SQL injection.
How do I fix CVE-2026-27832?
To fix CVE-2026-27832, upgrade Group-Office to versions 26.0.8, 25.0.87, or 6.8.153 or later.
What versions of Group-Office are affected by CVE-2026-27832?
CVE-2026-27832 affects Group-Office versions earlier than 26.0.8, 25.0.87, and 6.8.153.
Can CVE-2026-27832 be exploited remotely?
No, CVE-2026-27832 requires authenticated access, meaning an attacker must have valid credentials.
What type of attack is CVE-2026-27832 associated with?
CVE-2026-27832 is associated with SQL Injection attacks that manipulate database queries.