Vulnerability · Published Jul 20, 2026 · Assigned by GitHub_M

CVE-2026-27823Remote Code Execution Vulnerability in EGroupware

High 8.7

In plain English

A high-severity security flaw in egroupware from EGroupware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)1.0%top 37.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in EGroupware that may lead to Remote Code Execution (RCE). The issue allows an authenticated attacker to execute arbitrary commands on the server. If user self-registration is enabled, the vulnerability may be exploitable without prior authentication. The vulnerability stems from improper authorization checks combined with a file write primitive and an arbitrary file read vulnerability, which together enable full system compromise. This has been patched in versions 26.2.20260224 and 23.1.20260224.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	egroupware/egroupware	26.2.20260224	GHSA-h9qx-v5xp-ph8p
Packagist	egroupware/egroupware	23.1.20260224	GHSA-h9qx-v5xp-ph8p

Affected products (as reported)

Vendor	Product	Versions
EGroupware	egroupware	<= 26.2.20260216<= 23.1.20260131

Weakness: CWE-285 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/EGroupware/egroupware/security/advisories/GHSA-h9qx-v5xp-ph8p x_refsource_CONFIRM