SOGo EUVD-2026-30213

Exploitation requires all of the following: (1) a SOGo deployment prior to 5.12.7 using the SQL user-source backend on PostgreSQL or MariaDB; (2) userPasswordAlgorithm configured to a cleartext mode ('none', 'plain', or 'cleartext') so that passwords are stored without hashing - explicitly called out in the description and confirmed by the commented-out cleartext branch in SQLSource.m; (3) a low-privileged authenticated SOGo account that can reach the changePasswordForLogin flow (CVSS PR:L), with no user interaction needed. LDAP-backed user sources, hashed password schemes, and SOGo 5.12.7+ are not exploitable. CVSS AC:H further reflects that the attacker must craft a payload compatible with the surrounding UPDATE statement and the specific DB engine's quoting/escaping behavior.

Signals are largely consistent and point to moderate, not urgent, risk. CVSS 7.1 with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L reflects network reach but high attack complexity and required low-privilege authentication (a valid SOGo account able to invoke the password-change flow). EPSS is 0.03% (8th percentile) and SSVC reports Exploitation: none and Automatable: no, while Technical Impact is total - meaning successful exploitation is impactful (full DB read/write of the SOGo schema, potentially other tenants' credentials) but unlikely to be mass-exploited. There is no CISA KEV listing and no public exploit identified. One nuance worth flagging: the vulnerability only manifests when cleartext password storage is configured with PostgreSQL or MariaDB - non-default for security-conscious deployments - so real-world exposure should be assessed against that configuration rather than treating every SOGo install as vulnerable.

An attacker with valid SOGo credentials (their own account or a phished one) visits the change-password page and submits a new password containing a crafted single-quote-terminated SQL fragment; because the cleartext branch interpolates the value directly into UPDATE sogo_users SET c_password = '<input>' WHERE c_uid = '...', the appended SQL is executed against PostgreSQL/MariaDB. Depending on DB privileges, this can be used to read or modify other rows in the SOGo schema (including other users' cleartext passwords) or chain into broader DB compromise. No public PoC is identified, but the patch diff in PR #379 essentially documents the injection point.