EUVD-2026-42499
GHSA-5fp2-8g3x-xw93
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Network-accessible endpoint requires only a standard authenticated user (PR:L); SQL injection yields partial C/I/A impact within unchanged database scope.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint.
AnalysisAI
SQL injection in SOGo's allContactSearch endpoint permits authenticated users to inject arbitrary SQL via the unsanitized search parameter, affecting all SOGo releases before 5.12.7. An attacker with a valid SOGo account can manipulate backend SQL queries to read, alter, or partially disrupt contact database contents - confirmed by both the upstream fix commit and the vendor's 5.12.7 release announcement. EPSS sits at the 5th percentile (0.15%) and no CISA KEV listing exists, indicating no public exploit identified at time of analysis despite the straightforward CWE-89 root cause.
Technical ContextAI
SOGo is an open-source groupware server providing calendaring, contacts, and email access over CalDAV, CardDAV, and ActiveSync. The allContactSearch endpoint processes user-supplied search terms against a backend relational database (typically PostgreSQL or MySQL). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the search parameter is concatenated into a SQL query without parameterized binding or sufficient sanitization, allowing an authenticated caller to close the intended query context and append or modify SQL logic. No CPE strings were provided in the input data; affected scope is defined by the vendor as all releases prior to 5.12.7 per the release announcement and the fix commit at github.com/Alinto/sogo.
RemediationAI
Upgrade SOGo to version 5.12.7 or later, as documented in the vendor release announcement at https://www.sogo.nu/news/2026/sogo-v5127-released.html and patched in commit 1f7e5d2b2c2047c44a6a9e05f73c36491cb96d21 on the Alinto/sogo GitHub repository. If an immediate upgrade is not feasible, consider deploying a WAF or reverse-proxy rule on the allContactSearch endpoint to reject requests whose search parameter contains SQL metacharacters (single quotes, semicolons, comment sequences such as '--' or '/*'); note this may block edge-case legitimate search terms and should be tested against real usage patterns. Additionally, ensure SOGo is not exposed to networks where untrusted or anonymous users could obtain credentials, as reducing the authenticated user pool directly limits exploitability. No workaround fully substitutes for the code-level fix.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today