# CVE-2026-39179: Alinto SOGo SQL injection in password change and contact search

Source: https://junglewise.ai/threats/cve-2026-39179-alinto-sogo-sql-injection-in-password-change-and-contact-search  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-39179 · Severity: info · CVSS 8.8 · Published 2026-07-08

SOGo, an open-source collaborative groupware server, contains a security flaw in its contact search and password management features. An authenticated user can exploit this vulnerability to run unauthorized database commands, potentially leading to the theft of sensitive data, modification of other users' information, or full control over the database server. This issue specifically affects systems configured to use MariaDB or PostgreSQL with passwords stored in plain text.

Technologies: [Alinto Sogo](https://junglewise.ai/threats/technologies/sogo). Vendors: [Alinto](https://junglewise.ai/threats/vendors/alinto).

## Quick answers

**Is CVE-2026-39179 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39179 being exploited in the wild.

**How severe is CVE-2026-39179?** Informational severity, with a CVSS score of 8.8, published 8 July 2026.

**Which products and versions are affected?** Alinto Sogo < 5.12.7.

**Is there a fix for CVE-2026-39179?** A patch was published on 2026-03-30: SOGo v5.12.7 released to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39179 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-39179?** Check whether you run Alinto Sogo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in SOGo versions prior to 5.12.7 within the password change and contact search components. The flaw is triggered via the 'newPassword' parameter and affects installations utilizing MariaDB or PostgreSQL-based SQL user sources, specifically when the 'userPasswordAlgorithm' is set to none, plain, or cleartext. An authenticated attacker can leverage this to execute arbitrary SQL statements, potentially leading to database compromise or server-side code execution. The vendor has addressed this in version 5.12.7 by implementing proper SQL adaptation for user sources.

## Affected products

- Alinto SOGo < 5.12.7

## Timeline

- 2026-03-30: patched: SOGo v5.12.7 released to address the vulnerability.
- 2026-07-08: disclosed: CVE-2026-39179 published.

## References

- [https://github.com/Alinto/sogo/commit/1f7e5d2b2c2047c44a6a9e05f73c36491cb96d21](https://github.com/Alinto/sogo/commit/1f7e5d2b2c2047c44a6a9e05f73c36491cb96d21)
- [https://www.sogo.nu/news/2026/sogo-v5127-released.html](https://www.sogo.nu/news/2026/sogo-v5127-released.html)

## Related threats

- [SOGo server-side request forgery in Calendar web subscription](https://junglewise.ai/threats/cve-2026-127145-sogo-before-5-12-13-contains-a-server-side-request-forgery)
- [SOGo denial of service via IMAP greeting timeout](https://junglewise.ai/threats/cve-2026-127141-sogo-before-5-12-13-contains-a-denial-of-service-vulnerability)
- [SOGo Sieve script injection in notification address](https://junglewise.ai/threats/cve-2026-127135-sogo-before-5-12-13-contains-a-sieve-script-injection)
- [SOGo missing rate limiting in TOTP verification](https://junglewise.ai/threats/cve-2026-127131-sogo-before-5-12-13-contains-a-missing-rate-limiting)
- [SOGo improper cryptographic signature verification in S/MIME](https://junglewise.ai/threats/cve-2026-127121-sogo-before-5-12-13-contains-an-improper-cryptographic-signature)