Read the docs
TI-2026-07774 Aliases CVE-2026-8851GHSA-7vv4-j48f-wcx7

SOGo < 5.12.8 SQL Injection via addUserInAcls endpoint

Priority LOW 39CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can inject malicious SQL code to write extracted data into the sogo_acl table and retrieve it through the /acls API, establishing an out-of-band data exfiltration channel.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00316 24th percentileScored 2026-11-08
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

No affected products listed by the sources yet.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-8851
  2. 2026-10-03 Alias added: GHSA-7vv4-j48f-wcx7
  3. 2026-10-25 Priority changed: MEDIUM → LOW

References

Patch 1

Other 1

  • TI-2025-33539 NULL pointer dereference in Alinto SOPE CVSS 3.1HIGH 7.5
  • TI-2025-39345 Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter. CVSS 3.1MEDIUM 6.1
  • TI-2025-39344 alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter. CVSS 3.1MEDIUM 6.1
  • TI-2026-02638 Alinto SOGo cross site scripting CVSS 4.0MEDIUM 5.3
  • TI-2026-62981 SOGo before 5.12.11 Password Reset Token Interception via Origin Header CVSS 4.0HIGH 8.7
  • TI-2015-04539 Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0. CVSS 3.1HIGH 8.8
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences