CVE-2026-46446
HighSummary
SOGo before 5.12.7, when using PostgreSQL or MariaDB and storing cleartext passwords, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized access to the database, jeopardizing the integrity and confidentiality of user data.
Recommendation
It is recommended to update SOGo to version 5.12.7 or later and to avoid storing passwords in cleartext.
Other vulnerabilities in SOGo
See all- CVE-2026-46445High
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
- CVE-2015-5395High
CVE-2015-5395 is a cross-site request forgery (CSRF) vulnerability in SOGo before version 3.1.0. An attacker can exploit this vulnerability to perform unauthorized actions on behalf of the user.
- CVE-2026-39179Medium
A SQL injection vulnerability in SOGo before version 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality.
- CVE-2026-39178Medium
A SQL injection vulnerability in SOGo before version 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint.
- CVE-2026-8851High
SOGo versions up to 5.12.7 contain a SQL injection vulnerability in the Access Control List management functionality. An authenticated user can inject malicious SQL subqueries through the uid parameter of the addUserInAcls endpoint, allowing extraction of arbitrary data from the database. Attackers can write extracted data into the sogo_acl table and retrieve it via the /acls API, establishing an out-of-band data exfiltration channel.
Original NVD description (English source)
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.