CVE-2026-8851

Vulnerability

SOGo versions 5.12.7 and prior contain a SQL injection vulnerability in the Access Control List management functionality. The uid parameter of the addUserInAcls endpoint is not properly sanitized, allowing authenticated users to inject arbitrary SQL subqueries [1][2].

Exploitation

An attacker with valid credentials can send a crafted POST request to the addUserInAcls endpoint, embedding malicious SQL code in the uid parameter. The injected query executes within the database context, and the attacker can write the results of the subquery into the sogo_acl table. The exfiltrated data can then be retrieved by querying the /acls API, establishing an out-of-band data exfiltration channel [2].

Impact

Successful exploitation allows the attacker to extract arbitrary data from the SOGo database, potentially including sensitive information such as user credentials or email content. The CVSS v3 score is 8.1, indicating high severity, with high impact on confidentiality and integrity [2].

Mitigation

The vulnerability is fixed in SOGo version 5.12.8 [1][3]. Administrators are strongly advised to upgrade immediately, as all prior versions are affected. No workarounds have been published.