# CVE-2026-127111: SOGo improper restriction of excessive authentication attempts

Source: https://junglewise.ai/threats/cve-2026-127111-sogo-before-5-12-13-contains-an-improper-restriction-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-127111 · Severity: high · CVSS 7.4 · Published 2026-11-12

SOGo is an open-source groupware suite that provides email, calendaring, and contact management services. The vulnerability allows attackers to bypass password recovery security by repeatedly guessing secret-question answers without facing rate limiting or account lockout, enabling complete account takeover and unauthorized access to email and other user data.

Technologies: [Alinto Sogo](https://junglewise.ai/threats/technologies/sogo). Vendors: [Alinto](https://junglewise.ai/threats/vendors/alinto).

## Quick answers

**Is CVE-2026-127111 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-127111 being exploited in the wild.

**How severe is CVE-2026-127111?** High severity, with a CVSS score of 7.4, published 12 November 2026.

**Which products and versions are affected?** Alinto Sogo before 5.12.13.

**Is there a fix for CVE-2026-127111?** Yes: fixed in SOGo 5.12.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-127111 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-127111?** Check whether you run Alinto Sogo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in SOGo 5.12.13

## Technical details

The passwordRecoveryCheck endpoint in SOGo lacks rate limiting and lockout mechanisms, allowing brute-force attacks on secret-question answers (CWE-307). Once an attacker guesses the correct answer, they obtain a recovery JWT that can be used with the connect endpoint to reset the password and gain full account access, bypassing the need for the original credential. This affects accounts without TOTP two-factor authentication enabled.

## Affected products

- Alinto SOGo before 5.12.13

## Timeline

- 2026-11-12: disclosed
- 2026-11-04: patched: v5.12.13 released

## References

- [https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13](https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13)
- [https://www.vulncheck.com/advisories/sogo-before-unauthenticated-password-recovery-brute-force](https://www.vulncheck.com/advisories/sogo-before-unauthenticated-password-recovery-brute-force)

## Related threats

- [SOGo server-side request forgery in Calendar web subscription](https://junglewise.ai/threats/cve-2026-127145-sogo-before-5-12-13-contains-a-server-side-request-forgery)
- [SOGo denial of service via IMAP greeting timeout](https://junglewise.ai/threats/cve-2026-127141-sogo-before-5-12-13-contains-a-denial-of-service-vulnerability)
- [SOGo Sieve script injection in notification address](https://junglewise.ai/threats/cve-2026-127135-sogo-before-5-12-13-contains-a-sieve-script-injection)
- [SOGo missing rate limiting in TOTP verification](https://junglewise.ai/threats/cve-2026-127131-sogo-before-5-12-13-contains-a-missing-rate-limiting)
- [SOGo improper cryptographic signature verification in S/MIME](https://junglewise.ai/threats/cve-2026-127121-sogo-before-5-12-13-contains-an-improper-cryptographic-signature)