CVE-2026-33755 - Vulnerability Analysis

Overview

Group-Office < 6.8.158, < 25.0.92, and < 26.0.17 contain an authenticated SQL injection caused by improper input sanitization in the JMAP Contact/query endpoint, letting authenticated users with basic addressbook access extract arbitrary database data including session tokens, exploit requires authentication with basic addressbook access.

Severity & Score

Impact

Authenticated users can extract sensitive data and fully take over any account, including the System Administrator, without knowing passwords.

Mitigation

Upgrade to versions 6.8.158, 25.0.92, or 26.0.17 or later.

References

• https://github.com/Intermesh/groupoffice/security/advisories/GHSA-3gc4-5993-c2qc

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner