SOGo Webmail 5.12.7 contains a SQL injection vulnerability (CWE-89) in its Access Control List management feature. Authenticated users can exploit this by injecting malicious SQL code through the uid parameter of the addUserInAcls endpoint. The injected SQL subqueries allow attackers to extract arbitrary database data by writing it into the sogo_acl table and then retrieving it via the /acls API, effectively creating an out-of-band channel for data exfiltration. The vulnerability has a CVSS 4.0 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

Successful exploitation allows an authenticated user to extract arbitrary data from the backend database, compromising confidentiality and integrity of the system data. The attacker can establish an out-of-band data exfiltration channel via the sogo_acl table and /acls API. There is no indication of privilege escalation or availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — no official fix or remediation guidance is currently available from the vendor. Users should monitor the vendor advisory for updates and apply any official patches once released. Until then, restrict access to the addUserInAcls endpoint to trusted users only and consider additional application-layer filtering or monitoring to detect anomalous use of the uid parameter.