Is CVE-2026-46445 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46445 being exploited in the wild.

How severe is CVE-2026-46445?

High severity, with a CVSS score of 7.1, published 14 May 2026.

Is there a fix for CVE-2026-46445?

A patch was published on 2026-03-24: Fix committed to upstream repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46445 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-46445?

Check whether you run Alinto Sogo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46445: Alinto SOGo SQL injection in SQLSource

CVE-2026-46445 · Severity: high · CVSS 7.1 · Published 2026-05-14

SOGo, an open-source collaborative groupware server, is vulnerable to a security flaw that could allow unauthorized access to its underlying database. This issue specifically affects organizations using PostgreSQL or those storing user passwords in plain text. An attacker could potentially exploit this to steal sensitive user data, modify account information, or disrupt email and calendar services.

Technologies: Alinto Sogo. Vendors: Alinto.

Quick answers

Is CVE-2026-46445 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46445 being exploited in the wild.
How severe is CVE-2026-46445?: High severity, with a CVSS score of 7.1, published 14 May 2026.
Which products and versions are affected?: Alinto Sogo before 5.12.7.
Is there a fix for CVE-2026-46445?: A patch was published on 2026-03-24: Fix committed to upstream repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46445 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46445?: Check whether you run Alinto Sogo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in SOGo's SQLSource component due to improper neutralization of special elements in SQL commands. The flaw is primarily located in the credential handling logic, specifically within the `checkLogin` and password encryption routines in `SQLSource.m`. When PostgreSQL is used as a user source, or when other SQL databases (like MariaDB) are used with plain-text password algorithms (none, plain, or cleartext), attackers can inject malicious SQL via login fields. The fix involves migrating from manual string replacement of single quotes to using proper SQL adaptors and `EOQualifier` objects to safely handle parameters. This is a network-based attack that typically requires low privileges but high complexity due to specific configuration requirements.

Affected products

Alinto SOGo before 5.12.7

Timeline

2026-03-24: patched: Fix committed to upstream repository
2026-03-30: advisory: SOGo v5.12.7 released with security warning
2026-05-14: disclosed: CVE-2026-46445 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.