CVE-2026-39178

A SQL injection vulnerability exists in SOGo versions prior to 5.12.7 . The flaw originates from a lack of protective measures for the SQL query structure within the contact search component , specifically affecting the search parameter of the allContactSearch endpoint . Authenticated users can e...

CVE-2026-8851

SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can...