What is the CVSS score of CVE-2026-46446?

CVE-2026-46446 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of SOGo are affected by CVE-2026-46446?

SOGo versions before 5.12.7 contain a SQL injection vulnerability in the password change function affecting authenticated users on PostgreSQL or MariaDB backends storing plaintext passwords, with no…. A patch is available.

How to fix or mitigate CVE-2026-46446?

Within 24 hours: Identify all SOGo deployments and document which use PostgreSQL or MariaDB with plaintext password storage. Within 7 days: Deploy SOGo 5.12.7 patch across all affected instances and verify successful patching. Within 30 days: Audit all password storage configurations and migrate any remaining plaintext passwords to cryptographically secure hashing.

SOGo CVE-2026-46446

EUVD-2026-30213 HIGH

SQL Injection (CWE-89)

2026-05-14 mitre

GHSA-37h6-wqp6-qg5g

SQLi PostgreSQL Sogo

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 08:43 vuln.today

Analysis Generated

Jun 08, 2026 - 08:43 vuln.today

Patch available

May 14, 2026 - 04:16 EUVD

DescriptionCVE.org

SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.

AnalysisAI

SQL injection in SOGo versions prior to 5.12.7 allows authenticated users to inject arbitrary SQL when changing their password, provided the deployment uses PostgreSQL or MariaDB as the user backend and stores cleartext passwords. The flaw resides in the changePasswordForLogin routine where the new password value is interpolated directly into an UPDATE statement (c_password = '%@'). No public exploit identified at time of analysis, EPSS is very low (0.03%), and SSVC marks exploitation as 'none' - but the patched upstream code (PR #379, fixed in 5.12.7) confirms the vulnerability.

Technical ContextAI

SOGo is an open-source groupware server (calendar, address book, webmail) developed by Alinto. The affected code lives in SoObjects/SOGo/SQLSource.m, which implements user-source lookups and password operations against a relational database via the EOAdaptor abstraction. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): in changePasswordForLogin, the cleartext-mode branch built the UPDATE statement with NSString stringWithFormat and the @'%@' placeholder for the encrypted/new password, bypassing the EOKeyValueQualifier/appendSQLToString:withAdaptor: parameterization used elsewhere. The fix (commit referenced in PR #379) rewrites the path to use EOKeyValueQualifier objects for both c_password and c_uid with adaptor-aware SQL emission, removes the ad-hoc quote-doubling, and applies the same pattern to checkLogin and fetchContactsMatching. The flaw is database-engine-specific because exploitation depends on backend SQL semantics that accept the injected payload, hence the explicit PostgreSQL/MariaDB scoping.

RemediationAI

Vendor-released patch: upgrade to SOGo 5.12.7 or later, per the release notes at https://www.sogo.nu/news/2026/sogo-v5127-released.html and the upstream fix in https://github.com/Alinto/sogo/pull/379. Debian users should track the bug thread at https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg2100131.html for distribution updates. If immediate upgrade is not possible, switch userPasswordAlgorithm away from cleartext ('none'/'plain'/'cleartext') to a hashed scheme such as ssha512 (which forces SOGo down a non-vulnerable code path; trade-off: existing cleartext passwords must be migrated or users will need a reset), or temporarily disable the user-facing password-change endpoint in the SOGo web UI and force admin-mediated resets (trade-off: helpdesk load). Restricting network access to the SOGo web interface to trusted ranges reduces but does not eliminate exposure because the precondition is an authenticated account.