SOGo CVE-2026-46445

Exploitation requires (1) a SOGo instance prior to 5.12.7 configured with the SQL authentication source pointed at a PostgreSQL database (the CVE description explicitly scopes the bug to 'when PostgreSQL is used'); (2) network reachability to the SOGo web/login endpoint; and (3) low-privilege authenticated access per CVSS PR:L - typically a valid mailbox account - to reach the vulnerable checkLogin/changePassword/fetchContacts code paths. Limiting factors that reduce real-world risk: deployments using LDAP, MySQL, or SQLite for authentication are not affected; AC:H indicates the attacker must tailor payloads to the PostgreSQL quoting semantics that defeat the legacy single-quote escaping; and no user interaction is needed (UI:N) but credentials are. The pre-auth reachability of the login qualifier in checkLogin is not explicitly confirmed by NVD and should be verified against the patched diff before assuming PR:L is a hard prerequisite.

The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L, base 7.1) describes a network-reachable but high-complexity attack requiring low-privilege authentication, with high confidentiality and integrity impact - consistent with an authenticated SQLi in login/contact-search flows. Real-world urgency is tempered by a very low EPSS score (0.03%, 8th percentile), CISA SSVC marking Exploitation as 'none' and Automatable as 'no', and the absence of KEV listing or any public PoC, so this is no public exploit identified at time of analysis. Counterweighting that, SSVC rates Technical Impact as 'total' and the upstream diff clearly shows exploitable concatenation, so a motivated attacker with valid (even low-privilege) credentials against a PostgreSQL-backed instance could escalate to full data access. Note one tension worth verifying: PR:L is required, yet the patched code paths include checkLogin and changePasswordForLogin - pre-auth reachability of the login qualifier should be confirmed against the deployment to rule out unauthenticated injection.

An attacker with valid low-privilege SOGo credentials on a PostgreSQL-backed deployment submits a crafted login name or contact-search filter containing PostgreSQL-specific quoting that bypasses the legacy single-quote escaping in SQLSource.m. The injected fragment is concatenated into the UPDATE/SELECT statement issued by checkLogin, changePasswordForLogin, or fetchContactsMatching, allowing the attacker to read other users' password hashes and mailbox metadata or tamper with stored credentials. No public exploit identified at time of analysis, but the patch diff effectively documents the vulnerable sinks for any researcher building one.