Executive brief
SOGo, an open-source collaborative groupware server, contains a security flaw in its contact search and password management features. An authenticated user can exploit this vulnerability to run unauthorized database commands, potentially leading to the theft of sensitive data, modification of other users' information, or full control over the database server. This issue specifically affects systems configured to use MariaDB or PostgreSQL with passwords stored in plain text.
Technical details
A SQL injection vulnerability exists in SOGo versions prior to 5.12.7 within the password change and contact search components. The flaw is triggered via the 'newPassword' parameter and affects installations utilizing MariaDB or PostgreSQL-based SQL user sources, specifically when the 'userPasswordAlgorithm' is set to none, plain, or cleartext. An authenticated attacker can leverage this to execute arbitrary SQL statements, potentially leading to database compromise or server-side code execution. The vendor has addressed this in version 5.12.7 by implementing proper SQL adaptation for user sources.
Affected products
- Alinto SOGo < 5.12.7
Timeline
- 2026-03-30: patched: SOGo v5.12.7 released to address the vulnerability.
- 2026-07-08: disclosed: CVE-2026-39179 published.