CVE-2026-33755

HIGH

Authenticated SQL Injection in Contact/query addressBookIds filter

Title source: cna
STIX 2.1

Description

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.158, 25.0.92, and 26.0.17, an authenticated SQL Injection vulnerability in the JMAP `Contact/query` endpoint allows any authenticated user with basic addressbook access to extract arbitrary data from the database — including active session tokens of other users. This enables full account takeover of any user, including the System Administrator, without knowing their password. Versions 6.8.158, 25.0.92, and 26.0.17 fix the issue.

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.0039
EPSS Percentile 30.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-89
Status published
Products (4)
intermesh/group-office < 6.8.158
Intermesh/groupoffice < 25.0.92
Intermesh/groupoffice < 26.0.17
Intermesh/groupoffice < 6.8.158
Published Mar 27, 2026
Tracked Since Mar 29, 2026