Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

EGroupware bug bounty programs

egroupware.org Updated

EGroupware runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
11
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program EGroupware runs.

  • EGroupware

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

11 targets. 6 excluded.

  • https://www.egroupware.org

    Web

  • Authentication and identity: the SAML flow and identity-provider selection, LDAP and Active Directory backends, session issuance and password handling

    Products and areas

  • Calendar and addressbook, together with the CalDAV, CardDAV and GroupDAV interfaces that phones and external clients synchronise against

    Products and areas

  • Filemanager and the storage backends behind it, covering upload, path handling, sharing links and permissions

    Products and areas

  • Nextmatch, the grid and filter machinery nearly every module queries through

    Products and areas

  • The admin module and the setup and installation path, where an installer left reachable is a full compromise of the deployment

    Products and areas

  • The eTemplate framework, covering template loading and anything an authenticated user can upload into it

    Products and areas

  • The mail module end to end: IMAP and SMTP account handling, the compose path, attachment handling and how a message is rendered in the browser

    Products and areas

  • The permission model across applications: ACLs, group membership and what one account can read of another's data on a shared installation

    Products and areas

  • The published policy asks for security issues through the GitHub security tab on EGroupware/egroupware or by email to [email protected], and draws no boundary narrower than the application itself. Everything below sits inside that

    Products and areas

  • The REST and JSON API surface, plus anything a scripted or mobile client authenticates against

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Deliberate administrator configuration: a permission granted on purpose is a decision rather than a defect

  • Findings against release lines the project no longer ships

  • Missing security headers and other scanner output with no demonstrated impact

  • The project publishes no exclusions list, so what follows is ordinary out-of-scope territory rather than a stated policy position

  • The web server, PHP runtime and database an operator chose to run underneath, along with their configuration

  • Upstream PHP libraries and other third-party dependencies, unless EGroupware's own use of them is what makes the defect reachable

Recent changes

Reward and scope changes across every EGroupware program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in EGroupware products, from the NVD.

Search NVD
  • CVE-2026-22243 High

    EGroupware is a Web based groupware server written in PHP. A SQL Injection vulnerability exists in the core components of EGroupware prior to versions 23.1.20260113 and 26.0.20260113, specifically in the `Nextmatch` filter processing. The flaw allows authenticated attackers to inject arbitrary SQL commands into the `WHERE` clause of database queries. This is achieved by exploiting a PHP type juggl

  • CVE-2023-38327 Medium

    An issue was discovered in eGroupWare 17.1.20190111. A User Enumeration vulnerability exists under calendar/freebusy.php, which allows unauthenticated remote attackers to enumerate the users of web applications based on server response.

  • CVE-2023-38329 Medium

    An issue was discovered in eGroupWare 17.1.20190111. A cross-site scripting Reflected (XSS) vulnerability exists in calendar/freebusy.php, which allows unauthenticated remote attackers to inject arbitrary web script or HTML into the "user" HTTP/GET parameter, which reflects its input without sanitization.

  • CVE-2024-40614 Critical

    EGroupware before 23.1.20240624 mishandles an ORDER BY clause. This leads to json.php?menuaction=EGroupware\Api\Etemplate\Widget\Nextmatch::ajax_get_rows sort.id SQL injection by authenticated users for Address Book or InfoLog sorting.

  • CVE-2023-38328 Medium

    An issue was discovered in eGroupWare 17.1.20190111. An Improper Password Storage vulnerability affects the setup panel of under setup/manageheader.php, which allows authenticated remote attackers with administrator credentials to read a cleartext database password.

  • CVE-2017-14920 Medium

    Stored XSS vulnerability in eGroupware Community Edition before 16.1.20170922 allows an unauthenticated remote attacker to inject JavaScript via the User-Agent HTTP header, which is mishandled during rendering by the application administrator.

  • CVE-2014-2027 High

    eGroupware before 1.8.006.20140217 allows remote attackers to conduct PHP object injection attacks, delete arbitrary files, and possibly execute arbitrary code via the (1) addr_fields or (2) trans parameter to addressbook/csv_import.php, (3) cal_fields or (4) trans parameter to calendar/csv_import.php, (5) info_fields or (6) trans parameter to csv_import.php in (a) projectmanager/ or (b) infolog/,

  • CVE-2014-2988 High

    EGroupware Enterprise Line (EPL) before 1.1.20140505, EGroupware Community Edition before 1.8.007.20140506, and EGroupware before 14.1 beta allows remote authenticated administrators to execute arbitrary PHP code via crafted callback values to the call_user_func PHP function, as demonstrated using the newsettings[system] parameter. NOTE: this can be exploited by remote attackers by leveraging CVE-

About this page

This page gathers every public program listed under egroupware.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.