CVE-2026-46445: 
SOGo vulnerability analysis and mitigation

CVE-2026-46445 is a SQL injection vulnerability in SOGo, an open-source groupware server developed by Alinto, affecting all versions before 5.12.7 when PostgreSQL is used as the database backend. The vulnerability stems from improper neutralization of user-supplied input in SQL queries (CWE-89), allowing authenticated attackers to inject malicious SQL commands. It was published on May 14, 2026, with a patch committed on March 24, 2026 and released in SOGo 5.12.7. The CVSS v3.1 base score is 7.1 (High) (GitHub Advisory, ENISA EUVD).

The root cause is insufficient input sanitization in SoObjects/SOGo/SQLSource.m, where user-controlled input was directly interpolated into SQL query strings without using the appropriate database adaptor's escaping mechanisms. Specifically, functions such as checkLogin, changePasswordForLogin, and fetchContactsMatching constructed raw SQL strings using format specifiers rather than parameterized queries or the EOAdaptor-aware appendSQLToString:withAdaptor: method. The fix (commit 1f7e5d2) replaces direct string formatting with proper EOKeyValueQualifier objects and adaptor-aware SQL generation, ensuring database-specific escaping is applied. Exploitation requires network access and low-level authenticated privileges, with high attack complexity (GitHub PR #379, GitHub Advisory).

A low-privileged authenticated attacker can inject arbitrary SQL commands into SOGo's PostgreSQL database, enabling unauthorized reading of sensitive data (e.g., user credentials, calendar/contact records), modification or deletion of database records, and — depending on PostgreSQL configuration and privileges — potential execution of operating system commands via database extensions. The confidentiality and integrity impacts are rated High, while availability impact is Low (GitHub Advisory, ENISA EUVD).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.031% (10th percentile), indicating a low near-term exploitation probability. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, ENISA EUVD).

1. Reconnaissance: Identify SOGo instances running versions prior to 5.12.7 with PostgreSQL as the backend, using service banners, version disclosure pages, or network scanning tools.
2. Authentication: Obtain low-privileged credentials for the SOGo instance (e.g., a standard user account).
3. Identify injectable endpoints: Target SOGo functionality that interacts with the SQL source, such as login, password change, or contact search endpoints, which were identified as vulnerable in SQLSource.m.
4. Craft SQL injection payload: Inject SQL metacharacters (e.g., single quotes, SQL keywords) into input fields such as the username/login field or contact search filter to manipulate the underlying PostgreSQL query.
5. Extract or manipulate data: Use classic or blind SQL injection techniques to enumerate database tables, extract sensitive records (e.g., user credentials, contact data), or modify/delete records.
6. Escalate if possible: If the PostgreSQL account has elevated privileges, attempt to use COPY TO/FROM, pg_read_file, or CREATE EXTENSION to escalate to OS-level access (GitHub PR #379, GitHub Advisory).

• Network: Unusual or malformed HTTP requests to SOGo login, password change, or contact search endpoints containing SQL metacharacters (e.g., single quotes, UNION, SELECT, --, OR 1=1).
• Logs: SOGo application logs or PostgreSQL query logs showing malformed or unexpected SQL syntax; repeated authentication attempts with unusual username formats; PostgreSQL error messages related to SQL syntax errors from the SOGo service account.
• Database: Unexpected queries in PostgreSQL logs (pg_log) originating from the SOGo database user that include UNION SELECT, information_schema, or other enumeration patterns; unauthorized changes to user records or contact data.
• Process: Unexpected child processes spawned from the PostgreSQL service (indicative of OS command execution via database extensions).

The primary remediation is to upgrade SOGo to version 5.12.7 or later, which includes the fix committed in PR #379 (SOGo Release, GitHub Advisory). If immediate patching is not feasible, restrict network access to the SOGo instance to trusted networks only, and monitor PostgreSQL query logs for anomalous SQL patterns. Additionally, ensure the PostgreSQL account used by SOGo operates with minimal required privileges (principle of least privilege) to limit the impact of any successful injection. Deploying a Web Application Firewall (WAF) with SQL injection detection rules can provide an additional layer of defense.