CVE-2026-39178

SOGo versions before 5.12.7 are vulnerable to a SQL injection vulnerability in the allContactSearch endpoint. The root cause is a lack of protective measures for the SQL query structure, specifically within the search parameter . This allows authenticated users to execute arbitrary SQL statements...

CVE-2026-8851

SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can...