# CVE-2026-127145: SOGo server-side request forgery in Calendar web subscription

Source: https://junglewise.ai/threats/cve-2026-127145-sogo-before-5-12-13-contains-a-server-side-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-127145 · Severity: medium · CVSS 4.3 · Published 2026-11-12

SOGo is a groupware server that provides email, calendar, and collaboration services. An authenticated attacker can exploit a server-side request forgery flaw in the web calendar subscription feature to make the server connect to arbitrary internal systems, enabling network reconnaissance from the server's position to identify internal hosts, open ports, and services.

Technologies: [Alinto Sogo](https://junglewise.ai/threats/technologies/sogo). Vendors: [Alinto](https://junglewise.ai/threats/vendors/alinto).

## Quick answers

**Is CVE-2026-127145 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-127145 being exploited in the wild.

**How severe is CVE-2026-127145?** Medium severity, with a CVSS score of 4.3, published 12 November 2026.

**Which products and versions are affected?** Alinto Sogo before 5.12.13.

**Is there a fix for CVE-2026-127145?** Yes: fixed in 5.12.13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-127145 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-127145?** Check whether you run Alinto Sogo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.12.13

## Technical details

The vulnerability exists in the Calendar/addWebCalendar endpoint, which does not properly validate user-supplied URLs before initiating connections. An authenticated attacker can supply a crafted URL pointing to internal network destinations, and by triggering calendar reloads via the reload endpoint, can infer the presence and characteristics of internal systems based on connection outcomes (failures, timeouts, authentication prompts, or content errors). This allows network mapping from the server's vantage point without direct network access.

## Affected products

- Alinto SOGo before 5.12.13

## Timeline

- 2026-11-12: disclosed
- 2026-11-04: patched

## References

- [https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13](https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13)
- [https://www.vulncheck.com/advisories/sogo-before-ssrf-via-web-calendar-subscriptions](https://www.vulncheck.com/advisories/sogo-before-ssrf-via-web-calendar-subscriptions)

## Related threats

- [SOGo denial of service via IMAP greeting timeout](https://junglewise.ai/threats/cve-2026-127141-sogo-before-5-12-13-contains-a-denial-of-service-vulnerability)
- [SOGo Sieve script injection in notification address](https://junglewise.ai/threats/cve-2026-127135-sogo-before-5-12-13-contains-a-sieve-script-injection)
- [SOGo missing rate limiting in TOTP verification](https://junglewise.ai/threats/cve-2026-127131-sogo-before-5-12-13-contains-a-missing-rate-limiting)
- [SOGo improper cryptographic signature verification in S/MIME](https://junglewise.ai/threats/cve-2026-127121-sogo-before-5-12-13-contains-an-improper-cryptographic-signature)
- [SOGo improper restriction of excessive authentication attempts](https://junglewise.ai/threats/cve-2026-127111-sogo-before-5-12-13-contains-an-improper-restriction-of)