{"id":"CVE-2026-8851","aliases":["DEBIAN-CVE-2026-8851","EUVD-2026-30804","GHSA-7vv4-j48f-wcx7","UBUNTU-CVE-2026-8851","USN-8504-1"],"status":"published","title":"SOGo \u003c 5.12.8 SQL Injection via addUserInAcls endpoint","description":"SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can inject malicious SQL code to write extracted data into the sogo_acl table and retrieve it through the /acls API, establishing an out-of-band data exfiltration channel.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00316,"percentile":0.24873,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2026-05-18T20:10:10Z","modified":"2026-11-08T14:09:18Z","fixes":[{"ecosystem":"Debian:12","package":"sogo","fixed_in":["5.8.0-2+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sogo","fixed_in":["5.12.1-3+deb13u2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sogo","fixed_in":["2.2.17a-1.1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"sogo","fixed_in":["3.2.10-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"sogo","fixed_in":["4.3.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"sogo","fixed_in":["5.5.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"sogo","fixed_in":["5.12.4-1.2ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.0-2+deb12u3"}]}],"versions":["5.8.0-1","5.8.0-2+deb12u1","5.8.0-2+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.1-3+deb13u2"}]}],"versions":["5.12.1-3","5.12.1-3+deb13u1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.17a-1.1ubuntu0.1~esm1"}]}],"versions":["2.2.17a-1","2.2.17a-1.1","2.2.17a-1.1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.10-1ubuntu0.1~esm1"}]}],"versions":["3.2.10-1","3.2.10-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-1ubuntu0.1~esm1"}]}],"versions":["4.0.8-1","4.1.0-1","4.1.1-1","4.3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.1-1ubuntu0.1~esm1"}]}],"versions":["5.1.0-1","5.2.0-1","5.2.0-3","5.3.0-1","5.3.0-1build2","5.4.0-1","5.5.0-1","5.5.1-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.2-4","5.12.1-1","5.12.1-1build2","5.12.1-2","5.12.1-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.4-1.2ubuntu0.1~esm1"}]}],"versions":["5.12.1-3","5.12.4-1","5.12.4-1.1","5.12.4-1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.17a-1.1ubuntu0.1~esm1"}]}],"versions":["2.2.17a-1","2.2.17a-1.1","2.2.17a-1.1build1"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.10-1ubuntu0.1~esm1"}]}],"versions":["3.2.10-1","3.2.10-1build1"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-1ubuntu0.1~esm1"}]}],"versions":["4.0.8-1","4.1.0-1","4.1.1-1","4.3.0-1"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.1-1ubuntu0.1~esm1"}]}],"versions":["5.1.0-1","5.2.0-1","5.2.0-3","5.3.0-1","5.3.0-1build2","5.4.0-1","5.5.0-1","5.5.1-1"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"sogo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.4-1.2ubuntu0.1~esm1"}]}],"versions":["5.12.1-3","5.12.4-1","5.12.4-1.1","5.12.4-1.2"],"bundled":11}],"products":[{"vendor":"alinto","product":"sogo webmail"}],"references":[{"url":"https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.8","tags":["issue-tracking","release-notes","report"]},{"url":"https://www.sogo.nu/news/2026/sogo-v5128-released.html","tags":["patch","fix","report"]},{"url":"https://www.vulncheck.com/advisories/sogo-sql-injection-via-adduserinacls-endpoint","tags":["third-party-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8851","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7vv4-j48f-wcx7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8851.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-8851","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-8851","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8851","tags":["report"]},{"url":"https://github.com/Alinto/sogo/commit/f9b71059f4f382d7b337d16ce1257443ade43d02","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8504-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-33054","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-34462","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-63498","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-63499","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-71276","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-3054","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-8496","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46445","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46446","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-8851","title":"SOGo \u003c 5.12.8 SQL Injection via addUserInAcls endpoint","description":"SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can inject malicious SQL code to write extracted data into the sogo_acl table and retrieve it through the /acls API, establishing an out-of-band data exfiltration channel.","status":"published","published":"2026-05-18T20:10:10.844Z","modified":"2026-11-08T14:09:18.359Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-08T15:43:34.234229Z"}],"euvd":[{"id":"EUVD-2026-30804","description":"SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can inject malicious SQL code to write extracted data into the sogo_acl table and retrieve it through the /acls API, establishing an out-of-band data exfiltration channel.","status":"published","published":"2026-05-18T20:10:10Z","modified":"2026-11-08T14:09:18Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-08T15:13:06.469155Z"}],"ghsa":[{"id":"GHSA-7vv4-j48f-wcx7","title":"SOGo 5.12.7 contains a SQL injection vulnerability in the Access Control List management...","description":"SOGo 5.12.7 contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can inject malicious SQL code to write extracted data into the sogo_acl table and retrieve it through the /acls API, establishing an out-of-band data exfiltration channel.","status":"published","published":"2026-05-18T21:31:53Z","modified":"2026-05-18T21:32:04Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:08:12.004262Z"}],"nvd":[{"id":"CVE-2026-8851","description":"SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can inject malicious SQL code to write extracted data into the sogo_acl table and retrieve it through the /acls API, establishing an out-of-band data exfiltration channel.","status":"published","published":"2026-05-18T21:16:41.777Z","modified":"2026-07-23T20:10:00.13Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:19.39893Z"}],"osv":[{"id":"CVE-2026-8851","title":"SOGo \u003c 5.12.8 SQL Injection via addUserInAcls endpoint","description":"SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can inject malicious SQL code to write extracted data into the sogo_acl table and retrieve it through the /acls API, establishing an out-of-band data exfiltration channel.","status":"published","published":"2026-05-18T20:10:10.844Z","modified":"2026-11-09T02:31:00.330177442Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-09T03:16:44.651171Z"},{"id":"DEBIAN-CVE-2026-8851","description":"SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can inject malicious SQL code to write extracted data into the sogo_acl table and retrieve it through the /acls API, establishing an out-of-band data exfiltration channel.","status":"published","published":"2026-05-18T21:16:41.777Z","modified":"2026-10-01T03:03:53.330912726Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:05.506112Z"},{"id":"UBUNTU-CVE-2026-8851","description":"SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can inject malicious SQL code to write extracted data into the sogo_acl table and retrieve it through the /acls API, establishing an out-of-band data exfiltration channel.","status":"published","published":"2026-05-18T21:16:00Z","modified":"2026-07-06T20:31:07.507481171Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"USN-8504-1","title":"sogo vulnerabilities","description":"It was discovered that SOGo did not properly sanitize categories used\nfor events, tasks, and contacts. A remote authenticated attacker could\npossibly use this issue to perform cross-site scripting attacks. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04\nLTS, and Ubuntu 26.04 LTS. (CVE-2025-71276)\n\nIt was discovered that SOGo did not properly sanitize the hint query\nparameter. A remote attacker could possibly use this issue to perform\ncross-site scripting attacks. This issue only affected Ubuntu 26.04\nLTS. (CVE-2026-3054)\n\nIt was discovered that SOGo did not renew the one-time password when a\nuser disabled and re-enabled it, and used a shorter length than\nrecommended. A remote attacker could possibly use this issue to bypass\nauthentication. This issue only affected Ubuntu 22.04 LTS and Ubuntu\n26.04 LTS. (CVE-2026-33550)\n\nIt was discovered that SOGo did not properly use the SQL adaptor for\nthe user source, resulting in SQL injection when certain databases\nwere used. A remote authenticated attacker could possibly use this\nissue to obtain sensitive information or execute arbitrary SQL\ncommands. (CVE-2026-46445, CVE-2026-46446)\n\nIt was discovered that SOGo did not properly sanitize mail containing\nICS calendar invitations. A remote attacker could possibly use this\nissue to perform cross-site scripting attacks. This issue only\naffected Ubuntu 26.04 LTS. (CVE-2026-8496)\n\nIt was discovered that SOGo did not properly validate identifiers when\nmanaging access control lists. A remote authenticated attacker could\npossibly use this issue to perform SQL injection attacks and obtain\nsensitive information. (CVE-2026-8851)\n\nIt was discovered that SOGo did not properly sanitize the theme\nparameter. A remote attacker could possibly use this issue to perform\ncross-site scripting attacks. This issue only affected Ubuntu 18.04\nLTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2025-63499)\n\nIt was discovered that SOGo did not properly sanitize the userName\nparameter on the login page. A remote attacker could possibly use this\nissue to perform cross-site scripting attacks. This issue only\naffected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and\nUbuntu 22.04 LTS. (CVE-2025-63498)\n\nIt was discovered that SOGo did not properly sanitize attachments when\npreviewing them. A remote attacker could possibly use this issue to\nperform cross-site scripting attacks. This issue only affected Ubuntu\n16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.\n(CVE-2024-34462)\n\nIt was discovered that SOGo did not validate the signatures of SAML\nassertions it received when SAML was used for authentication. A remote\nattacker could possibly use this issue to impersonate other users.\nThis issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and\nUbuntu 20.04 LTS. (CVE-2021-33054)","status":"published","published":"2026-07-05T23:01:31Z","modified":"2026-07-06T20:44:29.515784604Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}