CVE-2026-46446: 
SOGo vulnerability analysis and mitigation

CVE-2026-46446 is a SQL injection vulnerability in SOGo, an open-source groupware server developed by Alinto, affecting versions before 5.12.7. The flaw exists in the changePasswordForLogin function within SQLSource.m, where user-supplied input is not properly sanitized before being interpolated into a raw SQL UPDATE statement via the c_password = '%@' format string. The vulnerability is only exploitable when PostgreSQL or MariaDB is used as the backend database and cleartext passwords are stored. It was published on May 14, 2026, and carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, ENISA EUVD).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), classified as a classic SQL injection. In the vulnerable code path, the changePasswordForLogin function in SoObjects/SOGo/SQLSource.m constructs an UPDATE SQL statement using [NSString stringWithFormat:] with unsanitized user input directly embedded into the query string (e.g., SET c_password = '%@' WHERE c_uid = '%@'). The fix, merged in pull request #379 on March 24, 2026, replaces the raw string formatting with EOKeyValueQualifier objects and the appendSQLToString:withAdaptor: method, which properly escapes values through the database adaptor layer. Exploitation requires the attacker to be authenticated with low privileges and to trigger the password change functionality; the attack complexity is rated High due to the specific configuration prerequisites (cleartext password storage with PostgreSQL or MariaDB) (GitHub PR #379, GitHub Advisory).

A low-privileged authenticated attacker can inject arbitrary SQL commands through the password change function, enabling unauthorized reading and modification of database contents. This includes exposure of sensitive user data such as credentials and authentication records, as well as the ability to tamper with the integrity of the authentication system. The confidentiality and integrity impacts are rated High, while availability impact is Low, reflecting the potential for data exfiltration and manipulation without necessarily causing a full service outage (GitHub Advisory, ENISA EUVD).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.028–0.031%, placing it in the 10th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, ENISA EUVD).

1. Reconnaissance: Identify a SOGo instance (version < 5.12.7) configured with PostgreSQL or MariaDB as the backend and cleartext password storage enabled. This can be inferred from public-facing SOGo login pages or version disclosure.
2. Authentication: Obtain or use existing low-privilege credentials to authenticate to the SOGo web interface.
3. Trigger password change: Navigate to the account settings or password change functionality within SOGo, which internally calls changePasswordForLogin.
4. Inject SQL payload: Supply a crafted new password value containing SQL metacharacters (e.g., ' , c_admin='1' WHERE '1'='1' --) that breaks out of the intended c_password = '%@' string context and appends or modifies the SQL UPDATE statement.
5. Achieve unauthorized database modification or data exfiltration: The injected SQL executes against the PostgreSQL or MariaDB backend, potentially modifying other users' records, escalating privileges within the application, or reading sensitive data via error-based or time-based techniques (GitHub PR #379, GitHub Advisory).

• Logs: SOGo application logs showing unexpected SQL errors or malformed query exceptions originating from the changePasswordForLogin code path; database error logs (PostgreSQL/MariaDB) recording syntax errors in UPDATE statements against the SOGo user table.
• Database: Unexpected modifications to user records in the SOGo database (e.g., changed c_password, c_uid, or privilege fields) not corresponding to legitimate user activity; audit logs showing UPDATE statements with unusual WHERE clauses or multiple field assignments in the password change context.
• Network: Unusual HTTP POST requests to SOGo's password change endpoint containing SQL metacharacters (', --, ;, /*) in password fields.

The primary remediation is to upgrade SOGo to version 5.12.7 or later, which replaces the vulnerable raw SQL string formatting with parameterized queries using the EOKeyValueQualifier adaptor layer. As an additional defense-in-depth measure, administrators should configure SOGo to use a strong cryptographic hashing algorithm (e.g., SSHA, bcrypt) for password storage rather than cleartext, which also eliminates the specific precondition for this vulnerability. No configuration-only workaround is available that fully mitigates the SQL injection without upgrading (SOGo Release News, GitHub PR #379).

The vulnerability was reported to the Debian bug tracking list and referenced in the SOGo 5.12.7 release announcement, indicating coordinated disclosure through standard open-source channels. No notable independent researcher commentary, social media discussion, or significant media coverage has been identified beyond standard vulnerability database aggregation (Debian Bug List, SOGo Release News).