Is CVE-2026-8851 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8851 being exploited in the wild.

How severe is CVE-2026-8851?

High severity, with a CVSS score of 8.1, published 18 May 2026.

Is there a fix for CVE-2026-8851?

A patch was published on 2026-05-12: SOGo version 5.12.8 released to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8851 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-8851?

Check whether you run Alinto Sogo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8851: Alinto SOGo SQL injection in addUserInAcls endpoint

CVE-2026-8851 · Severity: high · CVSS 8.1 · Published 2026-05-18

SOGo, an open-source collaborative software server, contains a security flaw in its access control management system. An authorized user can exploit this vulnerability to bypass security restrictions and extract sensitive information from the underlying database. This could lead to the theft of user credentials, private communications, or other confidential organizational data stored within the mail and calendar system.

Technologies: Alinto Sogo. Vendors: Alinto.

Quick answers

Is CVE-2026-8851 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8851 being exploited in the wild.
How severe is CVE-2026-8851?: High severity, with a CVSS score of 8.1, published 18 May 2026.
Which products and versions are affected?: Alinto Sogo <= 5.12.7.
Is there a fix for CVE-2026-8851?: A patch was published on 2026-05-12: SOGo version 5.12.8 released to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8851 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-8851?: Check whether you run Alinto Sogo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in SOGo versions 5.12.7 and earlier within the Access Control List (ACL) management functionality. The flaw is located in the 'addUserInAcls' endpoint, where the 'uid' parameter is improperly neutralized before being used in a database query. An authenticated attacker can inject malicious SQL subqueries to extract arbitrary data from the database. By writing the results of these subqueries into the 'sogo_acl' table, the attacker can subsequently retrieve the stolen data via the '/acls' API, effectively creating an out-of-band exfiltration channel. The issue is resolved in version 5.12.8.

Affected products

Alinto SOGo <= 5.12.7

Timeline

2026-05-12: patched: SOGo version 5.12.8 released to address the vulnerability.
2026-05-18: disclosed: CVE-2026-8851 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.