CVE-2026-46445
HighSummary
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized access to database data, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade SOGo to version 5.12.7 or later to mitigate the risk associated with this vulnerability.
Other vulnerabilities in SOGo
See all- CVE-2026-46446High
SOGo before 5.12.7, when using PostgreSQL or MariaDB and storing cleartext passwords, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.
- CVE-2015-5395High
CVE-2015-5395 is a cross-site request forgery (CSRF) vulnerability in SOGo before version 3.1.0. An attacker can exploit this vulnerability to perform unauthorized actions on behalf of the user.
- CVE-2026-39179Medium
A SQL injection vulnerability in SOGo before version 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality.
- CVE-2026-39178Medium
A SQL injection vulnerability in SOGo before version 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint.
- CVE-2026-8851High
SOGo versions up to 5.12.7 contain a SQL injection vulnerability in the Access Control List management functionality. An authenticated user can inject malicious SQL subqueries through the uid parameter of the addUserInAcls endpoint, allowing extraction of arbitrary data from the database. Attackers can write extracted data into the sogo_acl table and retrieve it via the /acls API, establishing an out-of-band data exfiltration channel.
Original NVD description (English source)
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.