CVE-2026-8496 is a cross-site scripting vulnerability in Alinto SOGo version 5.12.7. The vulnerability arises from insufficient sanitization of SVG content embedded in the description field of ICS calendar invitation files, specifically when an onrepeat event handler is present. When a victim views such a malicious calendar invite in their authenticated SOGo webmail session, arbitrary JavaScript can execute in their browser. This enables an attacker to perform actions such as accessing mailbox contents, stealing emails and contacts, and hijacking the user session.

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the context of an authenticated user's webmail session. This can lead to unauthorized mailbox access, theft of sensitive information including emails and contacts, session hijacking, and potentially other actions available to the authenticated user. The vulnerability requires user interaction (viewing the malicious calendar invite) and does not require prior privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when opening ICS calendar invitations from untrusted sources. Monitoring vendor channels for updates is recommended.