CVE-2026-27832: Intermesh Group-Office SQLi Vulnerability

CVE-2026-27832 Overview

A SQL Injection vulnerability has been identified in Group-Office, an enterprise customer relationship management and groupware tool developed by Intermesh. The vulnerability exists in versions prior to 26.0.8, 25.0.87, and 6.8.153, and is exploitable through the advancedQueryData parameter (specifically the comparator field) on an authenticated endpoint.

The vulnerable endpoint index.php?r=email/template/emailSelection processes the advancedQueryData parameter and forwards the SQL comparator without implementing a strict allowlist during SQL condition building. This weakness enables attackers to perform blind boolean-based SQL injection attacks, potentially allowing exfiltration of sensitive data from the core_auth_password table.

Critical Impact

Authenticated attackers can exploit this SQL Injection vulnerability to extract password hashes and other sensitive authentication data from the database, potentially leading to complete account compromise.

Affected Products

• Intermesh Group-Office versions prior to 26.0.8
• Intermesh Group-Office versions prior to 25.0.87
• Intermesh Group-Office versions prior to 6.8.153

Discovery Timeline

• 2026-02-27 - CVE-2026-27832 published to NVD
• 2026-03-04 - Last updated in NVD database

Technical Details for CVE-2026-27832

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) occurs due to improper input validation in the email template selection functionality of Group-Office. The application fails to properly sanitize user-supplied input in the comparator field of the advancedQueryData parameter before incorporating it into SQL queries.

The vulnerability requires authentication to exploit, meaning an attacker must have valid credentials to access the vulnerable endpoint. However, once authenticated, even a low-privileged user can leverage this flaw to extract sensitive information from the database through blind boolean-based SQL injection techniques.

The attack targets the core_auth_password table, which contains user authentication credentials. By crafting malicious SQL queries through the comparator field, an attacker can systematically extract password hashes character by character through true/false responses from the application.

Root Cause

The root cause of this vulnerability is the absence of a strict allowlist for SQL comparator operators in the advancedQueryData processing logic. The application accepts arbitrary comparator values from user input and directly incorporates them into dynamically constructed SQL conditions. This violates secure coding principles that mandate parameterized queries or strict input validation for all user-supplied data that influences SQL query construction.

Attack Vector

The attack is network-based and requires low privileges (authenticated access) with no user interaction needed. An authenticated attacker sends specially crafted requests to the index.php?r=email/template/emailSelection endpoint with malicious SQL syntax embedded in the comparator field of the advancedQueryData parameter.

The attacker constructs boolean-based blind SQL injection payloads that cause the application to respond differently based on whether injected SQL conditions evaluate to true or false. By iterating through possible values and observing application responses, the attacker can extract data from the core_auth_password table one character at a time.

For detailed technical information about this vulnerability, see the GitHub Security Advisory.

Detection Methods for CVE-2026-27832

Indicators of Compromise

• Unusual or repetitive requests to index.php?r=email/template/emailSelection containing complex or obfuscated advancedQueryData parameters
• Database query logs showing abnormal SQL comparator operators or boolean-based injection patterns
• Multiple sequential requests from the same authenticated user with slight variations in the comparator field
• Unexpected database errors or performance degradation associated with the email template functionality

Detection Strategies

• Implement web application firewall (WAF) rules to detect SQL injection patterns in POST/GET parameters, particularly targeting the advancedQueryData parameter
• Enable detailed application logging for the email template selection endpoint and monitor for suspicious query patterns
• Deploy database activity monitoring to detect unauthorized queries against the core_auth_password table
• Utilize SentinelOne Singularity Platform to detect and respond to SQL injection exploitation attempts in real-time

Monitoring Recommendations

• Configure alerts for high-frequency requests to the vulnerable endpoint from individual user sessions
• Monitor for unusual authentication failures following potential credential extraction attempts
• Set up database audit logging to track all queries accessing authentication-related tables
• Review access logs for patterns consistent with automated exploitation tools

How to Mitigate CVE-2026-27832

Immediate Actions Required

• Upgrade Group-Office to version 26.0.8, 25.0.87, or 6.8.153 or later immediately
• Review database audit logs for any evidence of prior exploitation attempts targeting the core_auth_password table
• Consider forcing password resets for all users if exploitation is suspected
• Implement additional authentication controls such as multi-factor authentication

Patch Information

Intermesh has released patched versions that address this SQL Injection vulnerability. Organizations should upgrade to one of the following fixed versions based on their current major version:

• Version 26.0.8 for organizations running the 26.x branch
• Version 25.0.87 for organizations running the 25.x branch
• Version 6.8.153 for organizations running the 6.x branch

For complete patch details and download information, refer to the GitHub Security Advisory.

Workarounds

• Restrict network access to the Group-Office application to trusted IP addresses only until patching is complete
• Implement a web application firewall rule to block requests containing suspicious patterns in the advancedQueryData parameter
• Temporarily disable or restrict access to the email template selection functionality if not business-critical
• Enhance monitoring of the vulnerable endpoint while awaiting patch deployment

# Example WAF rule to block suspicious advancedQueryData patterns
# Add to your web application firewall configuration
# Block requests with SQL injection patterns in advancedQueryData
SecRule ARGS:advancedQueryData "@rx (?i)(union|select|insert|update|delete|drop|exec|execute)" \
    "id:100001,phase:2,deny,status:403,msg:'Potential SQL Injection in advancedQueryData'"