What is the CVSS score of CVE-2026-46445?

CVE-2026-46445 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of SOGo are affected by CVE-2026-46445?

Alinto SOGo groupware deployments using PostgreSQL backends are vulnerable to SQL injection in authentication and contact-lookup functions that allows authenticated users to read or modify sensitive…. A patch is available.

How to fix or mitigate CVE-2026-46445?

Within 24 hours: Audit all SOGo instances to identify versions prior to 5.12.7, particularly PostgreSQL-backed deployments. Within 7 days: Apply SOGo 5.12.7 or later to all affected systems and conduct functional testing of authentication paths. Within 30 days: Review database access logs and application audit trails for suspicious query activity from authenticated user accounts during the vulnerable period.

SOGo CVE-2026-46445

EUVD-2026-30212 HIGH

SQL Injection (CWE-89)

2026-05-14 mitre

GHSA-vhv6-3crj-r8jm

SQLi PostgreSQL Sogo

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 08:48 vuln.today

Analysis Generated

Jun 08, 2026 - 08:48 vuln.today

Patch available

May 14, 2026 - 04:16 EUVD

DescriptionCVE.org

SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.

AnalysisAI

SQL injection in Alinto SOGo versions prior to 5.12.7 allows authenticated remote attackers to manipulate database queries when the groupware is deployed against a PostgreSQL backend. The flaw stems from improper quoting in the SQLSource authentication and contact-lookup paths, which an attacker can leverage to read or modify data with high confidentiality and integrity impact. No public exploit identified at time of analysis and EPSS is very low (0.03%), but a vendor patch and upstream code fix are available.

Technical ContextAI

SOGo is an open-source groupware server (calendar, address book, webmail) developed by Alinto, and the affected component is the Objective-C SQLSource module that builds SQL against the configured authentication source. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): pre-patch code in SoObjects/SOGo/SQLSource.m manually escaped single quotes via stringByReplacingString and concatenated user-controlled login, password, and contact-filter values directly into UPDATE and SELECT statements. The PostgreSQL backend uses different quoting/escaping semantics than MySQL or SQLite (e.g., backslash and dollar-quoting behaviors), so the ad-hoc single-quote doubling does not fully neutralize injection payloads. The fix in PR 379 replaces manual string concatenation with EOQualifier / EOKeyValueQualifier objects rendered through the active EOAdaptor, delegating proper parameter quoting to the database adapter layer.

RemediationAI

Apply the vendor-released patch by upgrading to SOGo 5.12.7 or later, as announced at https://www.sogo.nu/news/2026/sogo-v5127-released.html; the corresponding upstream code change is in Alinto/sogo PR #379 (https://github.com/Alinto/sogo/pull/379) which rewrites SQLSource.m to use EOQualifier/EOAdaptor parameterization. If immediate patching is not possible, compensating controls include switching the authentication source away from the SQL/PostgreSQL backend to LDAP (eliminates the vulnerable code path but requires a directory server and re-provisioning of accounts), restricting network access to the SOGo web interface to trusted management VLANs or via reverse-proxy ACLs (reduces exposure but breaks remote user access), and enforcing strong, unique credentials plus aggressive account lockout on the SOGo login endpoint to raise the cost of obtaining the low-privilege foothold the attack requires. Distribution users should also track the Debian advisory at https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg2100131.html for backported packages.