CVE-2026-39178

SOGo before 5.12.7, when using PostgreSQL or MariaDB and storing cleartext passwords, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.

SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.

CVE-2015-5395 is a cross-site request forgery (CSRF) vulnerability in SOGo before version 3.1.0. An attacker can exploit this vulnerability to perform unauthorized actions on behalf of the user.

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastructure, enabling account takeover.

A SQL injection vulnerability in SOGo before version 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality.

SOGo versions up to 5.12.7 contain a SQL injection vulnerability in the Access Control List management functionality. An authenticated user can inject malicious SQL subqueries through the uid parameter of the addUserInAcls endpoint, allowing extraction of arbitrary data from the database. Attackers can write extracted data into the sogo_acl table and retrieve it via the /acls API, establishing an out-of-band data exfiltration channel.