The vulnerability in SOGo Webmail arises from improper neutralization of special elements in SQL commands (CWE-89). Authenticated users can exploit this flaw in the Access Control List management by injecting malicious SQL code through the uid parameter of the addUserInAcls endpoint. This enables attackers to extract arbitrary database data by writing it into the sogo_acl table and retrieving it via the /acls API, effectively establishing an out-of-band data exfiltration channel. The CVSS 4.0 base score is 8.6, reflecting high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

Successful exploitation allows an authenticated user to extract arbitrary data from the backend database, compromising confidentiality. The attacker can also manipulate data within the sogo_acl table, impacting data integrity. This could lead to unauthorized data disclosure and potential further compromise of the system's access controls. There is no indication of availability impact or privilege escalation beyond the authenticated user level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, organizations should monitor vendor communications closely. In the meantime, restrict access to the addUserInAcls endpoint to trusted users only and consider additional application-layer filtering or monitoring to detect anomalous SQL injection attempts. Avoid exposing the vulnerable versions in untrusted environments until a fix is available.