# CVE-2026-8851: Alinto SOGo SQL injection in addUserInAcls endpoint

Source: https://junglewise.ai/threats/cve-2026-8851-alinto-sogo-sql-injection-in-adduserinacls-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-18. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-8851 · Severity: high · CVSS 8.1 · Published 2026-05-18

SOGo, an open-source collaborative software server, contains a security flaw in its access control management system. An authorized user can exploit this vulnerability to bypass security restrictions and extract sensitive information from the underlying database. This could lead to the theft of user credentials, private communications, or other confidential organizational data stored within the mail and calendar system.

Technologies: [Alinto Sogo](https://junglewise.ai/threats/technologies/sogo). Vendors: [Alinto](https://junglewise.ai/threats/vendors/alinto).

## Quick answers

**Is CVE-2026-8851 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8851 being exploited in the wild.

**How severe is CVE-2026-8851?** High severity, with a CVSS score of 8.1, published 18 May 2026.

**Which products and versions are affected?** Alinto Sogo <= 5.12.7.

**Is there a fix for CVE-2026-8851?** A patch was published on 2026-05-12: SOGo version 5.12.8 released to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8851 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8851?** Check whether you run Alinto Sogo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in SOGo versions 5.12.7 and earlier within the Access Control List (ACL) management functionality. The flaw is located in the 'addUserInAcls' endpoint, where the 'uid' parameter is improperly neutralized before being used in a database query. An authenticated attacker can inject malicious SQL subqueries to extract arbitrary data from the database. By writing the results of these subqueries into the 'sogo_acl' table, the attacker can subsequently retrieve the stolen data via the '/acls' API, effectively creating an out-of-band exfiltration channel. The issue is resolved in version 5.12.8.

## Affected products

- Alinto SOGo <= 5.12.7

## Timeline

- 2026-05-12: patched: SOGo version 5.12.8 released to address the vulnerability.
- 2026-05-18: disclosed: CVE-2026-8851 published.

## References

- [https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.8](https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.8)
- [https://www.sogo.nu/news/2026/sogo-v5128-released.html](https://www.sogo.nu/news/2026/sogo-v5128-released.html)
- [https://www.vulncheck.com/advisories/sogo-sql-injection-via-adduserinacls-endpoint](https://www.vulncheck.com/advisories/sogo-sql-injection-via-adduserinacls-endpoint)

## Related threats

- [SOGo server-side request forgery in Calendar web subscription](https://junglewise.ai/threats/cve-2026-127145-sogo-before-5-12-13-contains-a-server-side-request-forgery)
- [SOGo denial of service via IMAP greeting timeout](https://junglewise.ai/threats/cve-2026-127141-sogo-before-5-12-13-contains-a-denial-of-service-vulnerability)
- [SOGo Sieve script injection in notification address](https://junglewise.ai/threats/cve-2026-127135-sogo-before-5-12-13-contains-a-sieve-script-injection)
- [SOGo missing rate limiting in TOTP verification](https://junglewise.ai/threats/cve-2026-127131-sogo-before-5-12-13-contains-a-missing-rate-limiting)
- [SOGo improper cryptographic signature verification in S/MIME](https://junglewise.ai/threats/cve-2026-127121-sogo-before-5-12-13-contains-an-improper-cryptographic-signature)