CVE-2026-8851: 
SOGo vulnerability analysis and mitigation

CVE-2026-8851 is a SQL injection vulnerability in SOGo's Access Control List (ACL) management functionality, affecting SOGo versions 5.12.7 and prior. Authenticated attackers can inject malicious SQL subqueries through the uid parameter of the addUserInAcls endpoint to extract arbitrary data from the underlying database and exfiltrate it via the /acls API. The vulnerability was published on May 18, 2026, and a patch was released in SOGo v5.12.8. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 8.6 (High) (Github Advisory, SOGo Release).

The root cause is improper neutralization of special elements in an SQL command (CWE-89), where the uid parameter passed to the addUserInAcls endpoint is not properly sanitized or parameterized before being incorporated into database queries. An authenticated attacker can inject SQL subqueries that cause the database to write extracted data into the sogo_acl table, which is then retrievable through the /acls API — establishing an out-of-band data exfiltration channel. Exploitation requires only low-level authenticated access (any valid user account) and no user interaction, making it straightforward to weaponize over the network (Github Advisory, SOGo Release).

Successful exploitation allows any authenticated user to extract arbitrary data from the SOGo database, resulting in high confidentiality and integrity impact. Sensitive information such as user credentials, email metadata, calendar data, and other stored content could be exfiltrated through the /acls API without requiring elevated privileges. Availability is not directly impacted, but the ability to write arbitrary data into the sogo_acl table also introduces an integrity risk by potentially corrupting ACL records (Github Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The EPSS score is approximately 0.027% (8th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was credited to dninh of SACOMBANK for discovery (SOGo Release). Detection support is available via Nessus plugin 315314.

1. Authentication: Obtain valid credentials for any SOGo user account — even a low-privileged account is sufficient.
2. Identify target endpoint: Locate the addUserInAcls API endpoint on the target SOGo instance (e.g., https://<target>/SOGo/so/<username>/<resource>/addUserInAcls).
3. Craft malicious payload: Construct a request where the uid parameter contains a SQL subquery, such as uid=(SELECT <sensitive_column> FROM <table> LIMIT 1), designed to extract data from the database.
4. Inject and write to ACL table: Submit the crafted request; the injected subquery causes the database to evaluate the SQL and write the extracted value into the sogo_acl table as an ACL entry.
5. Retrieve exfiltrated data: Query the /acls API endpoint for the affected resource to read back the injected ACL entries, which now contain the extracted database content.
6. Iterate: Repeat with modified subqueries to enumerate additional tables, columns, or rows, systematically exfiltrating the desired data (Github Advisory).

• Network: Unusual or repeated HTTP POST requests to the addUserInAcls endpoint with anomalous or encoded uid parameter values containing SQL syntax (e.g., SELECT, FROM, parentheses, subquery patterns); subsequent GET requests to /acls API endpoints from the same source.
• Logs: SOGo application logs showing malformed or unexpected uid values in ACL management requests; database query logs recording unexpected SQL subqueries originating from the SOGo application user.
• Database: Unexpected or nonsensical entries in the sogo_acl table that do not correspond to valid user identifiers — particularly entries containing data from other tables or columns.

Alinto has released SOGo v5.12.8, which fixes this SQL injection vulnerability along with two XSS vulnerabilities and an OpenID impersonation issue. Administrators should upgrade to SOGo 5.12.8 or later as soon as possible (SOGo Release). As interim mitigations, restrict access to ACL management functions to trusted administrators only, implement network-level controls to limit who can reach the SOGo API, and monitor database query logs for suspicious SQL patterns or anomalous entries in the sogo_acl table.

The Alinto team acknowledged the vulnerability in their v5.12.8 release notes, crediting dninh of SACOMBANK for discovering and reporting the SQL injection, and urging all users to update immediately given the security severity of the release (SOGo Release). The vulnerability was also picked up in CISA's weekly vulnerability bulletin and covered by IT security news aggregators, though no significant independent researcher commentary or social media discussion has been observed beyond standard vulnerability tracking.