Alinto SOGo CVE-2026-8496

The victim must be an authenticated SOGo webmail user with an active browser session at the time the malicious invitation is viewed - the attacker is unauthenticated (PR:N per CVSS), but the victim's own session provides the privileged context that makes the XSS impactful. User interaction is required (UI:R): the victim must open and view the calendar invitation inside the SOGo webmail interface; simply receiving the email without viewing it in SOGo does not trigger execution. The attacker must have a delivery path to the victim's mailbox, typically via email. Exploitation is limited to the SOGo webmail rendering context - users who accept or view the same ICS file in a standalone calendar application (Apple Calendar, Thunderbird, etc.) are not exposed to this flaw. No special server-side configuration is required; the vulnerable code path is active in all default SOGo deployments running a version prior to 5.12.8.

The CVSS 6.1 Medium score is composed of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The PR:N (no privileges required) indicates the attacker needs no account on the target system - only the ability to send an email or calendar invite to the victim. However, UI:R (user interaction required) means exploitation is not automatable; the victim must actively open and view the malicious invitation in SOGo webmail. SSVC independently confirms Automatable: no and Technical Impact: partial, which is consistent. The Scope:Changed (S:C) rating is the most significant signal here: successful XSS execution crosses the browser's same-origin policy context and operates within the victim's fully authenticated SOGo session, giving the attacker capabilities beyond what the C:L/I:L base scores suggest - session hijacking, full mailbox read, and contact exfiltration are all plausible secondary impacts. EPSS of 0.04% (14th percentile) places this well below threshold for mass exploitation risk, and the absence from CISA KEV confirms no known active campaigns. The realistic threat model is targeted spear-phishing: an attacker who knows their target uses SOGo webmail sends a crafted calendar invite and waits for it to be viewed. This is a meaningful risk for organizations handling sensitive communications via SOGo, despite the moderate CVSS score.

An attacker targeting a SOGo user crafts an ICS calendar file with an SVG element embedded in the DESCRIPTION field - for example, an animate element carrying an onrepeat event handler that POSTs the victim's session cookie to an attacker-controlled endpoint. The attacker sends this as an email attachment or a calendar invitation to the target's address. When the victim opens the invitation in the SOGo webmail interface, the browser renders the SVG, the animation loop triggers the onrepeat handler, and the malicious JavaScript executes within the victim's authenticated session - silently exfiltrating credentials or performing further actions. No public exploit code has been identified at time of analysis, but the bypass technique (using an unlisted SVG event handler against a known blocklist) is straightforward to replicate from the public commit diff.