CVE-2026-39178
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A SQL injection vulnerability in SOGo before version 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint.
Risk Assessment
An attacker can gain unauthorized access to the database, steal or modify sensitive data, leading to a breach of system integrity and confidentiality.
Recommendation
Immediately update SOGo to version 5.12.7 or later, which includes a fix that eliminates the SQL injection vulnerability.
Other vulnerabilities in SOGo
See all- CVE-2026-46446High
SOGo before 5.12.7, when using PostgreSQL or MariaDB and storing cleartext passwords, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.
- CVE-2026-46445High
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
- CVE-2015-5395High
CVE-2015-5395 is a cross-site request forgery (CSRF) vulnerability in SOGo before version 3.1.0. An attacker can exploit this vulnerability to perform unauthorized actions on behalf of the user.
- CVE-2026-39179Medium
A SQL injection vulnerability in SOGo before version 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality.
- CVE-2026-8851High
SOGo versions up to 5.12.7 contain a SQL injection vulnerability in the Access Control List management functionality. An authenticated user can inject malicious SQL subqueries through the uid parameter of the addUserInAcls endpoint, allowing extraction of arbitrary data from the database. Attackers can write extracted data into the sogo_acl table and retrieve it via the /acls API, establishing an out-of-band data exfiltration channel.
Original NVD description (English source)
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint.