PT-2026-41735 · Sogo · Sogo

Dninh · Published 2026-05-18 · Updated 2026-05-19 · CVE-2026-8851

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions SOGo version 5.12.7

Description An issue in the Access Control List management functionality allows authenticated users to extract arbitrary data from the database. This is achieved by injecting SQL subqueries through the uid parameter of the "/addUserInAcls" endpoint. Attackers can use malicious SQL code to write extracted data into the sogo acl table and subsequently retrieve it via the "/acls" API, creating an out-of-band data exfiltration channel.

Recommendations As a temporary workaround, restrict access to the "/addUserInAcls" endpoint or avoid using the uid parameter until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-8851

Affected Products

Sogo

References · 16

• https://security-tracker.debian.org/tracker/CVE-2026-8851 · Vendor Advisory
• https://sogo.nu/news/2026/sogo-v5128-released.html · Patch
• https://cve.org/CVERecord?id=CVE-2026-8851 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-8851 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-8851 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-8851 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8851 · Security Note
• https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.8 · Note
• https://github.com/Alinto/sogo/commit/f9b71059f4f382d7b337d16ce1257443ade43d02 · Note
• https://vulncheck.com/advisories/sogo-sql-injection-via-adduserinacls-endpoint · Note
• https://twitter.com/ADKCyber/status/2056843541129662642 · Twitter Post
• https://t.me/CVEtracker/54160 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2056527765298438219 · Twitter Post
• https://t.me/cveNotify/163932 · Telegram Post
• https://twitter.com/CVEnew/status/2056670129489137925 · Twitter Post