Medium severity6.3OSV Advisory· Published Jul 8, 2026· Updated Jul 9, 2026

CVE-2026-39179

Description

A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality.

Affected products

Alinto/SogoOSV
Range: SOGo-5.12.6, SOGo-5.12.5, SOGo-5.12.4, …
Debian/sogollm-create
Range: <5.12.7
SOGo/SOGollm-fuzzy
Range: <5.12.7

Patches

Vulnerability mechanics

References

github.com/Alinto/sogo/commit/1f7e5d2b2c2047c44a6a9e05f73c36491cb96d21nvd
www.sogo.nu/news/2026/sogo-v5127-released.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.410
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000