Remote code execution via authorization bypass in EGroupware (CVE-2026-27823)

EGroupware contains an improper authorization check in `SmallPartMediaRecorder::ajax_upload()` that allows an attacker to bypass teacher-role verification by supplying a crafted `participant_role` value in request data. Chaining this with an arbitrary file write and an arbitrary file read in `importexport_export_ui::download` enables injection of arbitrary PHP code into `header.inc.php`, resulting in remote code execution and full system compromise. If user self-registration is enabled, the attack may be carried out without prior authentication. Affected versions: - <=26.2.20260216 - <=23.1.20260131 We recommend updating to: 26.2.20260224, 23.1.20260224. CVSS 8.7 · our assessment: this_week Reference: https://github.com/EGroupware/egroupware/security/advisories/GHSA-h9qx-v5xp-ph8p Details: https://vuln.today/cve/CVE-2026-27823