Group‑Office contains an authenticated blind boolean‑based SQL injection in the advancedQueryData comparator field of the email template selection endpoint, allowing attackers to exfiltrate contents of the core_auth_password table. This is a classic injection flaw (CWE‑89) that can lead to compromise of user passwords and creation of a foothold for further attacks.

The vulnerability exists in Intermesh Group‑Office versions prior to 26.0.8, 25.0.87, and 6.8.153. All affected releases prior to these fixed versions can be impacted by the flaw.

With a CVSS score of 7.1 and an EPSS probability of less than 1 %, the flaw is moderately high-risk but unlikely to be widely exploited currently; it is not listed in CISA's KEV catalog. The attack requires authenticated access to the application and leverages the unchecked comparator field to conduct blinded data extraction, potentially over multiple requests.