Threats affecting pkg:github/sogo

SOGo versions before 5.12.13 contain a server-side request forgery (SSRF) vulnerability that allows authenticated users to make the server connect to arbitrary internal host and port destinations. This is achieved by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can also trigger reloads of subscribed web calendars and observe different response outcomes to probe the internal network from the server's perspective.

SOGo versions before 5.12.13 have a denial of service vulnerability where authenticated attackers can exhaust all worker processes by configuring an IMAP account pointing to a host that accepts connections but never responds. This causes workers to be held indefinitely without timeout, denying service to all users for about five minutes until the workers are restarted.

CVE-2026-127135 is a vulnerability in SOGo versions before 5.12.13 that allows authenticated users to inject arbitrary Sieve directives via unescaped notification address values. This injection can enable attackers to embed redirect or discard statements in the Sieve script, bypassing forwarding-domain constraints and manipulating incoming mail handling.

SOGo versions before 5.12.13 have a vulnerability in the web login TOTP verification process that lacks rate limiting. This flaw allows attackers who know a victim's password to brute-force the second-factor authentication code without triggering lockout mechanisms, bypassing two-factor authentication.

SOGo versions before 5.12.13 have a vulnerability in cryptographic signature verification that allows remote attackers to replace a victim's contact S/MIME certificate. By sending a spoofed multipart/signed message with a mismatched signature and impersonated From address, attackers can inject a self-signed certificate into the victim's contact card. This flaw enables attackers to decrypt subsequent encrypted communications intended for the victim.

SOGo versions prior to 5.12.13 have a vulnerability that allows unauthenticated attackers to bypass authentication protections by repeatedly guessing answers to secret questions without any lockout or rate limiting. This flaw enables attackers to obtain a valid recovery token and reset account passwords, leading to full account takeover on accounts without two-factor authentication (TOTP).

CVE-2026-93453 is a high-severity vulnerability in Alinto SOGo versions prior to 5.12.11. The issue arises from the password recovery mechanism using the client-supplied Origin header to build password reset links. This flaw allows unauthenticated attackers to craft malicious Origin headers, causing password reset emails to contain links pointing to attacker-controlled domains. This can potentially enable account takeover by redirecting users to malicious sites during password recovery.