Sogo CVE-2025-71276

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates this is a network-accessible vulnerability with low attack complexity that requires low privilege (authenticated user) and requires no user interaction on the victim's part, with changed scope and low impact to confidentiality and integrity. While the CVSS score of 6.4 is moderate, the real-world risk is amplified by the fact that XSS in groupware applications targeting events, tasks, and contacts—frequently shared items in organizational contexts—creates high-value attack scenarios for lateral movement and data exfiltration within trusted networks. The lack of reported public exploitation, combined with the authentication requirement, mitigates immediate critical risk, but organizations with SOGo deployments should prioritize patching as XSS vulnerabilities in multi-user collaboration platforms can enable persistent compromise. This is a legitimate priority for organizations running affected versions, particularly those with sensitive collaborative workflows.

An authenticated SOGo user with low privilege creates a malicious calendar event containing embedded JavaScript that triggers when other users view the event details or synchronize their calendar. Alternatively, a compromised employee account or insider could inject XSS payloads into shared contact records or task descriptions, which then execute in the browsers of all team members who access those objects, stealing session tokens, exfiltrating data, or redirecting users to credential harvesting pages. The low attack complexity and lack of user interaction requirement on the victim's side makes this a practical attack vector in scenarios where the attacker already has legitimate access (e.g., a contractor account or compromised employee).