Threat Intelligence Database

A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality.

A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint.

CVE-2026-8851 is a high-severity SQL injection vulnerability in Alinto SOGo Webmail versions 5.12.7 and earlier. It affects the Access Control List management functionality, allowing authenticated users to inject SQL subqueries via the uid parameter of the addUserInAcls endpoint. This injection can be used to extract arbitrary data from the database by writing it into the sogo_acl table and retrieving it through the /acls API, creating an out-of-band data exfiltration channel. No official patch or remediation guidance has been provided yet, and no known exploits are reported in the wild.

CVE-2026-46446 is a high-severity SQL injection vulnerability in Alinto SOGo versions before 5.12.7 when using PostgreSQL or MariaDB with cleartext password storage. The flaw arises in the changePasswordForLogin function related to the c_password parameter, allowing improper neutralization of special elements in SQL commands. This vulnerability can lead to unauthorized access or data compromise due to the injection of malicious SQL code. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time. Users should monitor vendor advisories for updates and apply patches once released.

CVE-2026-46445 is a high-severity SQL injection vulnerability in Alinto SOGo versions prior to 5.12.7 when using PostgreSQL. This flaw allows improper neutralization of special elements in SQL commands, potentially leading to unauthorized data access or modification. The vulnerability has a CVSS score of 7.1, indicating significant confidentiality and integrity impact with limited availability impact. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time. Users should monitor vendor advisories for updates and apply patches once available.

A cross-site scripting (XSS) vulnerability exists in Alinto SOGo version 5.12.7. This flaw allows arbitrary JavaScript execution within an authenticated user's webmail session when viewing a maliciously crafted ICS calendar invitation containing SVG content with an onrepeat event handler. Exploitation could lead to mailbox access, theft of emails and contacts, session hijacking, and other actions permitted to the authenticated user.

A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue occurs because SVG content embedded in the description field of an ICS file, with an onrepeat event handler, is insufficiently sanitized before being rendered in the webmail interface. A remote attacker can execute JavaScript in the victim's browser when the malicious calendar invite is viewed. Successful exploitation may allow mailbox access, email and contact theft, session hijacking, and other actions allowed by an authenticated user.

CVE-2026-33550 is a low-severity vulnerability in Alinto's SOGo email and collaboration platform versions before 5.12.5. The issue involves improper handling of one-time passwords (OTPs) used for multi-factor authentication (MFA). Specifically, when a user disables and then re-enables OTP-based MFA, the system fails to renew the OTP secret, and the OTP length is only 12 digits instead of the recommended 20 digits. This weakness effectively reduces the strength of the second authentication factor, increasing the risk of unauthorized access through OTP guessing or replay attacks. Exploitation requires high privileges and user interaction, and no known exploits exist in the wild. Organizations using vulnerable SOGo versions should upgrade to 5.12.5 or later and enforce stronger OTP configurations to mitigate this risk.

LowVulnerabilityUnited StatesFranceGermany+7#cve#cve-2026-33550#cwe-308

A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4. This impacts an unknown function. The manipulation of the argument hint leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

MediumVulnerabilityFranceGermanyUnited States+7#cve#cve-2026-3054

alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.

MediumVulnerabilityFranceGermanyUnited Kingdom+4#cve#cve-2025-63498