Alinto SOGo vulnerabilities and threats

CVE-2026-8496 is a cross-site scripting (XSS) vulnerability in Alinto SOGo version 5.12.7. It arises from insufficient sanitization of SVG content with an onrepeat event handler embedded in the description field of ICS calendar invitation files. When a malicious calendar invite is viewed in the authenticated SOGo webmail session, arbitrary JavaScript can execute. This may allow attackers to access mailbox contents, steal emails and contacts, hijack sessions, and perform other actions permitted to the authenticated user. The vulnerability is fixed in version 5.12.8.