Executive brief
SOGo is an open-source collaborative software (groupware) server focused on sharing calendars, address books, and emails. A security flaw in the password change and contact search features allows logged-in users to perform unauthorized database operations. This could lead to an attacker changing other users' passwords, stealing sensitive data, or potentially taking control of the server.
Technical details
A SQL injection vulnerability exists in SOGo's SQLSource component, specifically affecting the allContactSearch endpoint and the password change functionality. The flaw stems from improper sanitization of the 'search' parameter when interacting with PostgreSQL or MariaDB user sources. An authenticated attacker can exploit this to execute arbitrary SQL commands. Depending on the database configuration and user source type, this can lead to mass password resets, database compromise, or server-side code execution. The issue is resolved in version 5.12.7 by using proper SQL adapters for user sources.
Affected products
- Alinto SOGo < 5.12.7
Timeline
- 2026-03-26: patched: Fixed in nightly builds
- 2026-03-30: advisory: SOGo v5.12.7 released
- 2026-07-08: disclosed: CVE published