EUVD-2026-124532

SOGo before 5.12.13 contains a Sieve script injection vulnerability that allows authenticated users to inject arbitrary Sieve directives by inserting unescaped notification address values into a generated Sieve script. Attackers can embed Sieve redirect or discard statements within the...

CVE-2026-127135

SOGo versions prior to 5.12.13 are vulnerable to a Sieve script injection vulnerability. This issue occurs because the application fails to escape notification address values when generating Sieve scripts. Authenticated users can exploit this by inserting unescaped values into the notificationAdd...