PT-2026-28528 · Unknown · Group-Office

Published 2026-03-27 · Updated 2026-03-28 · CVE-2026-33755

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Group-Office versions prior to 6.8.158 Group-Office versions prior to 25.0.92 Group-Office versions prior to 26.0.17

Description Group-Office is an enterprise customer relationship management and groupware tool. An authenticated SQL Injection vulnerability exists in the JMAP Contact/query endpoint. This allows any authenticated user with basic addressbook access to extract arbitrary data from the database, including active session tokens of other users. Successful exploitation enables full account takeover of any user, including the System Administrator, without knowing their password. The vulnerability affects the Contact/query API endpoint and allows access to data through SQL injection via the JMAP interface.

Recommendations Update Group-Office to version 6.8.158. Update Group-Office to version 25.0.92. Update Group-Office to version 26.0.17.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-33755

GHSA-3GC4-5993-C2QC

Affected Products

Group-Office

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33755.json · Exploit
• 🔥 https://github.com/Intermesh/groupoffice/security/advisories/GHSA-3gc4-5993-c2qc · Exploit
• https://osv.dev/vulnerability/CVE-2026-33755 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33755 · Security Note
• https://twitter.com/TheHackerWire/status/2037681209757864147 · Twitter Post
• https://twitter.com/CveFindCom/status/2037556132814668276 · Twitter Post