Is CVE-2026-127145 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-127145 being exploited in the wild.

How severe is CVE-2026-127145?

Medium severity, with a CVSS score of 4.3, published 12 November 2026.

Is there a fix for CVE-2026-127145?

Yes: fixed in 5.12.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-127145 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-127145?

Check whether you run Alinto Sogo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-127145: SOGo server-side request forgery in Calendar web subscription

CVE-2026-127145 · Severity: medium · CVSS 4.3 · Published 2026-11-12

SOGo is a groupware server that provides email, calendar, and collaboration services. An authenticated attacker can exploit a server-side request forgery flaw in the web calendar subscription feature to make the server connect to arbitrary internal systems, enabling network reconnaissance from the server's position to identify internal hosts, open ports, and services.

Technologies: Alinto Sogo. Vendors: Alinto.

Quick answers

Is CVE-2026-127145 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-127145 being exploited in the wild.
How severe is CVE-2026-127145?: Medium severity, with a CVSS score of 4.3, published 12 November 2026.
Which products and versions are affected?: Alinto Sogo before 5.12.13.
Is there a fix for CVE-2026-127145?: Yes: fixed in 5.12.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-127145 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-127145?: Check whether you run Alinto Sogo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.12.13

Technical details

The vulnerability exists in the Calendar/addWebCalendar endpoint, which does not properly validate user-supplied URLs before initiating connections. An authenticated attacker can supply a crafted URL pointing to internal network destinations, and by triggering calendar reloads via the reload endpoint, can infer the presence and characteristics of internal systems based on connection outcomes (failures, timeouts, authentication prompts, or content errors). This allows network mapping from the server's vantage point without direct network access.

Affected products

Alinto SOGo before 5.12.13

Timeline

2026-11-12: disclosed
2026-11-04: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.