EGroupware

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 5 Last 12 months 5 Lifetime Remote code execution 40 % SQL injection 20 % File inclusion 20 % Authentication flow 20 % Latest advisories Loading the feed Overview EGroupware bundles mail, calendar, contacts and file management into one web application, sold and supported commercially and installed across German public administration, schools and mid-sized businesses. A single server holds the correspondence and the calendars of an entire organisation. CVE-2026-27823 is the reference point, a critical remote code execution fixed in July 2026 that arrived alongside a second authenticated code-execution flaw in the same batch. Every advisory the project has ever published landed inside the last twelve months, so the surface is barely explored rather than exhausted. There is no bounty and no reward programme behind the product, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The published policy asks for security issues through the GitHub security tab on EGroupware/egroupware or by email to [email protected] , and draws no boundary narrower than the application itself. Everything below sits inside that The mail module end to end: IMAP and SMTP account handling, the compose path, attachment handling and how a message is rendered in the browser Calendar and addressbook, together with the CalDAV, CardDAV and GroupDAV interfaces that phones and external clients synchronise against The eTemplate framework, covering template loading and anything an authenticated user can upload into it Nextmatch, the grid and filter machinery nearly every module queries through Authentication and identity: the SAML flow and identity-provider selection, LDAP and Active Directory backends, session issuance and password handling The REST and JSON API surface, plus anything a scripted or mobile client authenticates against Filemanager and the storage backends behind it, covering upload, path handling, sharing links and permissions The admin module and the setup and installation path, where an installer left reachable is a full compromise of the deployment The permission model across applications: ACLs, group membership and what one account can read of another's data on a shared installation Out of scope The project publishes no exclusions list, so what follows is ordinary out-of-scope territory rather than a stated policy position Upstream PHP libraries and other third-party dependencies, unless EGroupware's own use of them is what makes the defect reachable The web server, PHP runtime and database an operator chose to run underneath, along with their configuration Deliberate administrator configuration: a permission granted on purpose is a decision rather than a defect Findings against release lines the project no longer ships Missing security headers and other scanner output with no demonstrated impact Most-valued findings Remote code execution above everything else. It is the densest part of this project's short record: CVE-2026-27823 was rated critical, and CVE-2026-40187 reached execution through a malicious eTemplate upload in the same July 2026 batch Any upload path that reaches code execution or an arbitrary file write, since eTemplate has already proven to be one of them SQL injection through the Nextmatch filter machinery or anywhere else a filter string reaches a query. CVE-2026-22243 landed there, and nearly every module in the suite queries through the same component File inclusion and URI-scheme handling, particularly where a user-supplied file:// or similar reaches a fetch, the shape CVE-2026-45016 took in mail compose Identity binding in the SAML flow. CVE-2026-63672 let a user control which identity provider was selected, and on a public-sector deployment that is a route into someone else's account Cross-account data access on a shared installation, where one user's mail, calendar entries or files become readable by another Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through GitHub private vulnerability reporting on EGroupware/egroupware or by email to [email protected] ; the policy names both and private reporting is switched on If you need to send material securely, ask for keys first. The policy says the team will send you its PGP keys on request rather than publishing them Test against the current 26.x release line, since that is what the project ships and fixes Name the application module the finding sits in. This is a large suite and a report that only says EGroupware costs triage time before anyone can start State the authentication level your finding needs. The July 2026 batch carried both a critical remote code execution and a separate authenticated one, and that distinction is what drives severity here There is no payment to negotiate: the project publishes no bounty and no reward terms Disclosure Coordinated privately with the maintainers through the GitHub security tab or the security address, then published as GitHub Security Advisories alongside a fixed release. The record moves in batches: the critical remote code execution and the eTemplate upload flaw went out together on 6 July 2026. No day count is published, so plan for an embargo running to the next release rather than to a fixed number of days. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability