The flaw is a classic SQL injection in the Nextmatch filter handling of EGroupware. An authenticated user can submit JSON-encoded input that is decoded into numeric values, bypassing the is_int() security check that protects the WHERE clause of database queries. This type juggling mistake enables the attacker to inject and execute arbitrary SQL statements, potentially reading, modifying, or deleting data from the database. The vulnerability resides in core PHP code used by the web‑based groupware interface.

All community editions of EGroupware running versions older than 23.1.20260113 and 26.0.20260113 are affected. The fix was delivered in those two releases, so any installation of those earlier versions must update to the patched releases.

The CVSS score of 8.7 signals high severity, while the EPSS score is less than 1 %, indicating a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation has been confirmed yet. An attacker must first be authenticated to EGroupware, but once logged in they can craft malicious Nextmatch filter parameters to inject SQL, with the potential for significant data exposure or alteration depending on database access rights.