EUVD-2026-42500
GHSA-7hjm-3p3p-89wx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Network-accessible password change endpoint requires an authenticated user (PR:L); SQL injection impact bounded to the SOGo database schema with no scope change (S:U, C:L/I:L/A:L).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality.
AnalysisAI
SQL injection in SOGo's password change functionality allows authenticated users to execute arbitrary SQL against the backend database by supplying crafted values in the newPassword parameter. Versions before 5.12.7 are confirmed affected when using SQL-backed authentication sources; the fix is available in SOGo 5.12.7 as confirmed by the vendor release announcement. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.15% (5th percentile), consistent with SSVC exploitation status of 'none.'
Technical ContextAI
SOGo is an open-source groupware server (calendaring, contacts, email) developed by Alinto, implemented in Objective-C using the GNUstep/SOPE framework. The vulnerability (CWE-89) resides in SoObjects/SOGo/SQLSource.m within the changePasswordForLogin: method, which constructs a raw SQL UPDATE statement using NSString stringWithFormat: to interpolate the encryptedPassword value directly into the query string - specifically the pattern 'UPDATE %@ SET c_password = ''%@'' WHERE c_uid = ''%@'''. While the login parameter received apostrophe-escaping, the password value did not, creating the injection surface. The fix replaces this pattern with EOKeyValueQualifier-based parameterized query construction via the EOAdaptor layer, which properly handles quoting across database backends. The NVD CPE field lists 'n/a n/a,' so no formal CPE string is available; affected products are identified from the vendor advisory and commit diff.
RemediationAI
Upgrade to SOGo 5.12.7 or later as confirmed by the vendor release at https://www.sogo.nu/news/2026/sogo-v5127-released.html; this version replaces raw SQL string interpolation with EOKeyValueQualifier-based parameterized queries, eliminating the injection surface. If an immediate upgrade is not feasible, restrict access to the password-change endpoint via reverse proxy ACLs or network controls to limit it to trusted network segments - note this degrades self-service password management for remote users. Additionally, reviewing and tightening the database service account's permissions to the minimum required schema can reduce the blast radius of a successful injection. Deploying WAF rules to detect SQL metacharacters in password change request bodies may provide partial detection coverage but is not a reliable standalone control given potential bypass techniques.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today