CVE-2026-127145
SOGo before 5.12.13 SSRF via Web Calendar Subscriptions
SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server's position.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
What each source reports
CVE List Score used
SOGo before 5.12.13 SSRF via Web Calendar Subscriptions
SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server's position.
- Record
CVE-2026-127145- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-12
EUVDEUVD-2026-124534
SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server's position.
- Record
EUVD-2026-124534- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N - Updated
- 2026-11-12
GitHub AdvisoriesGHSA-m3cx-88pq-ww6w
SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows...
SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server's position.
- Record
GHSA-m3cx-88pq-ww6w- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-12
NVD
SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server's position.
- Record
CVE-2026-127145- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-13
OSV
SOGo before 5.12.13 SSRF via Web Calendar Subscriptions
SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server's position.
- Record
CVE-2026-127145- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N - Weakness
- CWE-918
- Updated
- 2026-11-13
OSVDEBIAN-CVE-2026-127145
SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server's position.
- Record
DEBIAN-CVE-2026-127145- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-13
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sogoDebian:12 | All versions, plus listed versions 5.10.0-15.10.0-25.10.0-35.11.0-15.11.0-2 Show 32 moreShow less5.11.1-15.11.2-15.11.2-25.11.2-35.11.2-45.12.0-15.12.1-15.12.1-25.12.1-35.12.10-15.12.11-15.12.12-15.12.13-15.12.3-15.12.3-25.12.4-15.12.4-1.15.12.4-1.25.12.6-15.12.7-15.12.8-15.12.8-25.12.9-15.8.0-15.8.0-2+deb12u15.8.0-2+deb12u25.8.0-2+deb12u35.8.2-15.8.3-15.8.4-15.9.0-15.9.1-1 | None known |
sogoDebian:13 | All versions, plus listed versions 5.12.1-35.12.1-3+deb13u15.12.1-3+deb13u25.12.1-3+deb13u35.12.10-1 Show 13 moreShow less5.12.11-15.12.12-15.12.13-15.12.3-15.12.3-25.12.4-15.12.4-1.15.12.4-1.25.12.6-15.12.7-15.12.8-15.12.8-25.12.9-1 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| references | OSV | |
| affected, aliases, references | OSV | |
| published | EUVD | |
| published | EUVD | |
| aliases, references | GitHub Advisories | |
| aliases, products, published | EUVD, NVD | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-127145 is a medium vulnerability (CVSS 5.3) in Alinto Sogo, published November 12, 2026. No source lists public exploit code. No source names a fixed version.
References
github.com/Alinto/sogo/releases/tag/SOGo-5.12.13
vulncheck.com/advisories/sogo-before-ssrf-via-web-calendar-subscriptions
nvd.nist.gov/vuln/detail/CVE-2026-127145
security-tracker.debian.org/tracker/CVE-2026-127145