CVE-2026-8851
highpriority · track · 0EPSS 0.003 · 24 %ileEURUEPSS · scored 2026-10-27
SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can inject malicious SQL code to write extracted data into the sogo_acl table and retrieve it through the /acls API, establishing an out-of-band data exfiltration channel.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.2–8.6
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (16)
Products and version ranges known to be affected.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.8cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2026-8851cnnvd
- https://www.sogo.nu/news/2026/sogo-v5128-released.htmlcnnvd
- https://www.vulncheck.com/advisories/sogo-sql-injection-via-adduserinacls-endpointcnnvd
- https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.8enisa_euvd
- https://www.sogo.nu/news/2026/sogo-v5128-released.htmlenisa_euvd
- https://www.vulncheck.com/advisories/sogo-sql-injection-via-adduserinacls-endpointenisa_euvd
- https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.8nvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan