Is CVE-2026-46446 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46446 being exploited in the wild.

How severe is CVE-2026-46446?

High severity, with a CVSS score of 7.1, published 14 May 2026.

Is there a fix for CVE-2026-46446?

A patch was published on 2026-03-24: Fix committed to upstream repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46446 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-46446?

Check whether you run Alinto Sogo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46446: Alinto SOGo SQL injection in changePasswordForLogin

CVE-2026-46446 · Severity: high · CVSS 7.1 · Published 2026-05-14

SOGo, an open-source collaborative software server, is vulnerable to a security flaw in its password management system. When configured to use PostgreSQL or MariaDB with cleartext passwords, an attacker could manipulate database queries to gain unauthorized access to data or disrupt operations. Organizations using these specific database configurations should update to version 5.12.7 immediately to protect their user credentials and system integrity.

Technologies: Alinto Sogo. Vendors: Alinto.

Quick answers

Is CVE-2026-46446 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46446 being exploited in the wild.
How severe is CVE-2026-46446?: High severity, with a CVSS score of 7.1, published 14 May 2026.
Which products and versions are affected?: Alinto Sogo < 5.12.7.
Is there a fix for CVE-2026-46446?: A patch was published on 2026-03-24: Fix committed to upstream repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46446 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46446?: Check whether you run Alinto Sogo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An SQL injection vulnerability exists in SOGo's 'changePasswordForLogin' function within the SQLSource component. The root cause is the improper neutralization of special elements (CWE-89) when handling the 'c_password' field, specifically where the code used string formatting instead of proper SQL adaptors for parameterization. This vulnerability is exploitable when SOGo is configured with a PostgreSQL or MariaDB user source and 'userPasswordAlgorithm' is set to 'none', 'plain', or 'cleartext'. An authenticated attacker with low privileges could potentially execute arbitrary SQL commands to read, modify, or delete database content. The issue is resolved in version 5.12.7 by implementing proper SQL adaptors for user source queries.

Affected products

Alinto SOGo < 5.12.7

Timeline

2026-03-24: patched: Fix committed to upstream repository
2026-03-30: advisory: SOGo v5.12.7 released with security warning
2026-05-14: disclosed: CVE-2026-46446 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.