Threats affecting pkg:github/alinto/sogo

A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality.

A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint.

CVE-2026-8851 is a high-severity SQL injection vulnerability in Alinto SOGo Webmail versions 5.12.7 and earlier. It affects the Access Control List management functionality, allowing authenticated users to inject SQL subqueries via the uid parameter of the addUserInAcls endpoint. This injection can be used to extract arbitrary data from the database by writing it into the sogo_acl table and retrieving it through the /acls API, creating an out-of-band data exfiltration channel. No official patch or remediation guidance has been provided yet, and no known exploits are reported in the wild.

CVE-2026-46446 is a high-severity SQL injection vulnerability in Alinto SOGo versions before 5.12.7 when using PostgreSQL or MariaDB with cleartext password storage. The flaw arises in the changePasswordForLogin function related to the c_password parameter, allowing improper neutralization of special elements in SQL commands. This vulnerability can lead to unauthorized access or data compromise due to the injection of malicious SQL code. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time. Users should monitor vendor advisories for updates and apply patches once released.

CVE-2026-46445 is a high-severity SQL injection vulnerability in Alinto SOGo versions prior to 5.12.7 when using PostgreSQL. This flaw allows improper neutralization of special elements in SQL commands, potentially leading to unauthorized data access or modification. The vulnerability has a CVSS score of 7.1, indicating significant confidentiality and integrity impact with limited availability impact. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time. Users should monitor vendor advisories for updates and apply patches once available.

CVE-2026-8496 is a cross-site scripting (XSS) vulnerability in Alinto SOGo version 5.12.7. It arises from insufficient sanitization of SVG content with an onrepeat event handler embedded in the description field of ICS calendar invitation files. When a malicious calendar invite is viewed in the authenticated SOGo webmail session, arbitrary JavaScript can execute. This may allow attackers to access mailbox contents, steal emails and contacts, hijack sessions, and perform other actions permitted to the authenticated user. The vulnerability is fixed in version 5.12.8.

CVE-2026-33550 is a low-severity vulnerability in Alinto's SOGo email and collaboration platform versions before 5.12.5. The issue involves improper handling of one-time passwords (OTPs) used for multi-factor authentication (MFA). Specifically, when a user disables and then re-enables OTP-based MFA, the system fails to renew the OTP secret, and the OTP length is only 12 digits instead of the recommended 20 digits. This weakness effectively reduces the strength of the second authentication factor, increasing the risk of unauthorized access through OTP guessing or replay attacks. Exploitation requires high privileges and user interaction, and no known exploits exist in the wild. Organizations using vulnerable SOGo versions should upgrade to 5.12.5 or later and enforce stronger OTP configurations to mitigate this risk.

alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.

Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component.

Alinto SOGo through 5.10.0 allows XSS during attachment preview.