CVE-2026-27832 Overview
CVE-2026-27832 is a SQL Injection vulnerability [CWE-89] in Intermesh Group-Office, an enterprise customer relationship management (CRM) and groupware platform. The flaw exists in the advancedQueryData parameter, specifically the comparator field, on the authenticated index.php?r=email/template/emailSelection endpoint. The endpoint forwards the SQL comparator into condition building without a strict allowlist, enabling blind boolean-based SQL injection. Authenticated attackers can exfiltrate sensitive data from the core_auth_password table, exposing credential material. Versions prior to 26.0.8, 25.0.87, and 6.8.153 are affected.
Critical Impact
Authenticated attackers can perform blind boolean-based SQL injection to exfiltrate password hashes from the core_auth_password table, leading to credential compromise across Group-Office user accounts.
Affected Products
- Intermesh Group-Office versions prior to 26.0.8
- Intermesh Group-Office versions prior to 25.0.87
- Intermesh Group-Office versions prior to 6.8.153
Discovery Timeline
- 2026-02-27 - CVE-2026-27832 published to NVD
- 2026-03-04 - Last updated in NVD database
Technical Details for CVE-2026-27832
Vulnerability Analysis
The vulnerability resides in the email template selection endpoint at index.php?r=email/template/emailSelection. This endpoint accepts an advancedQueryData structure used to filter or query records. Within this structure, the comparator field is intended to specify a SQL comparison operator such as =, <, or LIKE. Group-Office passes the value of comparator directly into SQL condition assembly without validating it against a strict allowlist of acceptable operators.
Because the comparator is injected into the WHERE clause as raw SQL, an authenticated attacker can substitute SQL fragments that alter query logic. The endpoint responds differently based on whether the injected boolean condition evaluates true or false, enabling blind boolean-based extraction. Repeated requests allow byte-by-byte enumeration of arbitrary database contents, including the core_auth_password table that stores authentication credentials.
Root Cause
The root cause is missing input validation on the comparator field. The application accepts the field as user-controlled data and concatenates it into a SQL query rather than mapping it to a fixed set of safe operators or using parameterized queries. This is a classic CWE-89 pattern where SQL syntax elements are derived from untrusted input.
Attack Vector
Exploitation requires an authenticated session with low privileges, as indicated by the network attack vector and PR:L scope. An attacker with any valid Group-Office account sends crafted POST or GET requests to index.php?r=email/template/emailSelection with a malicious comparator value inside advancedQueryData. The attacker iterates payloads to extract password hashes one character at a time. No user interaction is required and exploitation complexity is low. Refer to the GitHub Security Advisory GHSA-vfgv-8w8v-qpxr for further technical details.
Detection Methods for CVE-2026-27832
Indicators of Compromise
- Repeated authenticated requests to index.php?r=email/template/emailSelection from a single session within short time windows.
- POST or GET bodies containing advancedQueryData with unusual comparator values such as SQL keywords (AND, OR, SELECT, UNION, SLEEP, SUBSTRING).
- Web server access logs showing high-volume identical-length requests to the email template selection endpoint, consistent with boolean-based extraction.
- Database query logs referencing the core_auth_password table from the Group-Office application user.
Detection Strategies
- Inspect application and web server logs for comparator values that do not match the allowlist of valid SQL operators.
- Deploy web application firewall (WAF) rules to flag SQL keywords and metacharacters appearing in the advancedQueryData.comparator field.
- Correlate authenticated session activity with abnormal request volume against the email template endpoint to identify automated extraction.
Monitoring Recommendations
- Enable verbose query logging on the Group-Office database and alert on queries touching core_auth_password outside expected authentication flows.
- Monitor for new or unexpected administrative session creation following bursts of requests to the affected endpoint.
- Track outbound traffic from the Group-Office server for signs of post-compromise credential reuse against other systems.
How to Mitigate CVE-2026-27832
Immediate Actions Required
- Upgrade Group-Office to version 26.0.8, 25.0.87, or 6.8.153 depending on the deployed major version.
- Rotate all user passwords and invalidate active sessions if exploitation is suspected, since core_auth_password contents may have been exfiltrated.
- Audit Group-Office accounts for unexpected privilege changes or newly created users.
- Restrict access to the Group-Office web interface to trusted networks or VPN while patching is scheduled.
Patch Information
Intermesh has released fixed versions 26.0.8, 25.0.87, and 6.8.153 that implement a strict allowlist for the comparator field in advancedQueryData. Administrators should consult the GitHub Security Advisory GHSA-vfgv-8w8v-qpxr for upgrade guidance and verify the running version after deployment.
Workarounds
- If immediate patching is not possible, deploy WAF rules that reject requests to index.php?r=email/template/emailSelection containing non-allowlisted comparator values such as anything other than =, !=, <, <=, >, >=, or LIKE.
- Limit authenticated access to the email template selection feature through application-level role restrictions where feasible.
- Enforce strong password policies and multi-factor authentication to reduce the impact of any extracted password hashes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.