CVE-2026-33755: Group-Office JMAP SQLI Vulnerability

CVE-2026-33755 Overview

A SQL Injection vulnerability has been identified in Group-Office, an enterprise customer relationship management and groupware tool. Prior to versions 6.8.158, 25.0.92, and 26.0.17, an authenticated SQL Injection vulnerability in the JMAP Contact/query endpoint allows any authenticated user with basic addressbook access to extract arbitrary data from the database — including active session tokens of other users. This enables full account takeover of any user, including the System Administrator, without knowing their password.

Critical Impact

Authenticated attackers can exploit this SQL Injection to extract sensitive database contents including active session tokens, enabling complete account takeover of any user including System Administrators.

Affected Products

• Group-Office versions prior to 6.8.158
• Group-Office versions prior to 25.0.92
• Group-Office versions prior to 26.0.17

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-33755 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-33755

Vulnerability Analysis

This vulnerability is classified as CWE-89: SQL Injection, a well-known web application vulnerability that occurs when user-supplied input is improperly sanitized before being incorporated into SQL queries. In this case, the JMAP Contact/query endpoint in Group-Office fails to adequately validate or parameterize user input, allowing authenticated attackers to inject malicious SQL commands.

The impact of this vulnerability is significant as it allows attackers to extract arbitrary data from the database. Most critically, attackers can retrieve active session tokens belonging to other users, including administrators. With a stolen session token, an attacker can impersonate any user without needing their credentials, effectively bypassing authentication entirely.

The attack surface requires only basic addressbook access, which is commonly granted to most authenticated users in Group-Office deployments. This low privilege requirement combined with the high impact of session token theft makes this vulnerability particularly dangerous in enterprise environments.

Root Cause

The root cause of this vulnerability lies in improper input validation and sanitization in the JMAP Contact/query endpoint. User-controlled input is incorporated directly into SQL queries without proper parameterization or escaping, allowing attackers to manipulate the query structure and extract unauthorized data from the database.

Attack Vector

The attack is network-based and requires authentication with minimal privileges (basic addressbook access). An attacker can exploit this vulnerability by sending specially crafted requests to the JMAP Contact/query endpoint containing malicious SQL syntax. The injected SQL commands are executed in the context of the database, allowing data extraction through techniques such as UNION-based injection, blind SQL injection, or error-based injection depending on the application's response behavior.

The exploitation does not require user interaction and can be performed programmatically, enabling automated extraction of database contents including user credentials and session tokens. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-33755

Indicators of Compromise

• Unusual or malformed requests to the JMAP Contact/query endpoint containing SQL syntax characters such as single quotes, semicolons, or UNION keywords
• Database query logs showing unexpected query patterns or data extraction attempts against user session tables
• Authentication anomalies where users appear to access accounts from unusual locations or without proper login events
• Web server logs indicating repeated requests to the Contact/query endpoint with varying payloads

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in requests to Group-Office endpoints
• Monitor database query logs for anomalous queries, especially those targeting session or authentication tables
• Deploy intrusion detection systems with signatures for SQL injection attack patterns
• Audit application logs for failed authentication attempts followed by successful session-based access

Monitoring Recommendations

• Enable detailed logging on the Group-Office application and associated database server
• Configure alerting for access patterns indicative of session hijacking, such as simultaneous sessions from geographically distant locations
• Regularly review access logs for the JMAP API endpoints for suspicious activity
• Monitor for bulk data extraction patterns that may indicate database exfiltration

How to Mitigate CVE-2026-33755

Immediate Actions Required

• Upgrade Group-Office immediately to version 6.8.158, 25.0.92, or 26.0.17 or later depending on your release branch
• Review database access logs for any evidence of exploitation
• Invalidate all active user sessions and require re-authentication after applying the patch
• Audit user accounts for any unauthorized access or changes

Patch Information

Group-Office has released patched versions that address this SQL Injection vulnerability. Organizations should upgrade to the following fixed versions based on their current release branch:

• Version 6.8.158 for the 6.8.x branch
• Version 25.0.92 for the 25.x branch
• Version 26.0.17 for the 26.x branch

For additional details, refer to the GitHub Security Advisory.

Workarounds

• Implement a Web Application Firewall (WAF) with SQL injection detection rules as a temporary protective measure
• Restrict network access to the Group-Office application to trusted networks only until patching is complete
• Consider temporarily disabling addressbook functionality if business operations permit
• Monitor and audit all access to the JMAP API endpoints for suspicious activity until the patch can be applied

# Example: Restrict access to Group-Office using iptables (temporary mitigation)
# Allow only trusted IP ranges to access Group-Office
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP