PatchSiren cyber security CVE debrief
CVE-2026-8851 Alinto CVE debrief
A SQL injection vulnerability in SOGo versions 5.12.7 and prior allows authenticated attackers to extract arbitrary database data through the Access Control List management functionality. The vulnerability resides in the `addUserInAcls` endpoint where the `uid` parameter fails to properly sanitize user input, enabling SQL subquery injection. Attackers can leverage this to write extracted data into the `sogo_acl` table and subsequently retrieve it via the `/acls` API, establishing an out-of-band data exfiltration channel. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no required user interaction, and low privileges required, with high impacts to confidentiality and integrity. The vulnerability was disclosed on 2026-05-18 and modified on 2026-05-19. SOGo version 5.12.8 has been released to address this issue.
- Vendor
- Alinto
- Product
- SOGo Webmail
- CVSS
- HIGH 8.6
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-18
- Original CVE updated
- 2026-05-19
- Advisory published
- 2026-05-18
- Advisory updated
- 2026-05-19
Who should care
Organizations running SOGo versions 5.12.7 or earlier for email and groupware services; security teams responsible for database-backed web applications; administrators managing SOGo deployments with multi-user ACL configurations
Technical summary
The vulnerability exists in SOGo's Access Control List management functionality, specifically the `addUserInAcls` endpoint. The `uid` parameter accepts unsanitized input that can be manipulated to inject SQL subqueries. This allows authenticated attackers with low privileges to: (1) inject malicious SQL to extract arbitrary data from the database, (2) write extracted data into the `sogo_acl` table as a staging area, and (3) retrieve the exfiltrated data through legitimate `/acls` API calls. The attack requires network access and valid authentication credentials but no user interaction. The CVSS 4.0 score of 8.6 reflects high confidentiality and integrity impacts with a network attack vector and low attack complexity.
Defensive priority
HIGH
Recommended defensive actions
- Upgrade to SOGo 5.12.8 or later to remediate the SQL injection vulnerability
- Review and restrict access to ACL management functionality to trusted administrative users only
- Monitor database query logs for anomalous SQL subqueries or unexpected writes to the sogo_acl table
- Implement Web Application Firewall rules to detect and block SQL injection patterns in the uid parameter of addUserInAcls requests
- Audit existing sogo_acl table entries for unauthorized data that may have been exfiltrated prior to patching
- Validate input sanitization on all SOGo API endpoints handling database queries
Evidence notes
Vulnerability confirmed through official SOGo release notes and VulnCheck advisory. CWE-89 (SQL Injection) classification provided by disclosure source. Fix version 5.12.8 explicitly mentioned in vendor release materials.
Official resources
2026-05-18T21:16:41.777Z