Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.8, 25.0.87, and 6.8.153 have a SQL Injection (SQLi) vulnerability, exploitable through the `advancedQueryData` parameter (`comparator` field) on an authenticated endpoint. The endpoint `index.php?r=email/template/emailSelection` processes `advancedQueryData` and forwards the SQL comparator without a strict allowlist into SQL condition building. This enables blind boolean-based exfiltration of the `core_auth_password` table. Versions 26.0.8, 25.0.87, and 6.8.153 fix the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-27832 Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.8, 25.0.87, and 6.8.153 have a SQL Injection (SQLi) vulnerab… https://www.cve.org/CVERecord?id=CVE-2026-27832
Post summary
CVE-2026-27832 is a SQL Injection vulnerability affecting Group-Office versions prior to 26.0.8, 25.0.87, and 6.8.153.
CVE-2026-27832 SQL Injection in Group-Office CRM Versions Prior to 26.0.8, 25.0.... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27832 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The post announces a SQL injection flaw in Group‑Office CRM versions before 26.0.8/25.0, linking to a Vulmon page but providing no exploit or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | intermesh | group-office | - | - | - |