CVE-2026-8851
HighSummary
SOGo versions 5.12.7 and prior contain a SQL injection vulnerability in the Access Control List management functionality. This allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint.
Risk Assessment
Attackers can inject malicious SQL code, allowing data exfiltration from the database and writing extracted data into the sogo_acl table, creating a risk of unauthorized access to sensitive information.
Recommendation
It is recommended to update SOGo to the latest version to mitigate this vulnerability and review application security to minimize SQL injection risks.
Original NVD description (English source)
SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can inject malicious SQL code to write extracted data into the sogo_acl table and retrieve it through the /acls API, establishing an out-of-band data exfiltration channel.