CVE-2026-39179
Deferred Deferred - Pending Action

SQL Injection in SOGo Before 5.12.7

Publication date: 2026-07-08

Last updated on: 2026-07-09

Assigner: MITRE

Description
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-08
Last Modified
2026-07-09
Generated
2026-07-16
AI Q&A
2026-07-09
EPSS Evaluated
2026-07-14
NVD
CVE-2026-39179
EUVD
EUVD-2026-42500

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
inverse sogo to 5.12.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL injection issue found in SOGo versions before 5.12.7. It allows authenticated users to execute arbitrary SQL statements by exploiting the newPassword parameter in the password change functionality.

Impact Analysis

An attacker who is authenticated can exploit this vulnerability to run arbitrary SQL commands on the database. This could lead to unauthorized data access, data modification, or even deletion, potentially compromising the integrity and confidentiality of the system's data.

Compliance Impact

The SQL injection vulnerabilities in SOGo before version 5.12.7 could lead to database compromise and unauthorized access to sensitive information, which may impact compliance with data protection regulations such as GDPR and HIPAA.

Specifically, the ability for authenticated users to execute arbitrary SQL statements could result in unauthorized data access or modification, potentially violating confidentiality and integrity requirements mandated by these standards.

Organizations using affected versions of SOGo with PostgreSQL or MariaDB storing cleartext passwords are at higher risk and should update immediately to mitigate these compliance risks.

Detection Guidance

This vulnerability is a SQL injection in SOGo before version 5.12.7 affecting the password change functionality via the newPassword parameter. Detection involves identifying if your SOGo installation is running a vulnerable version and if it uses PostgreSQL or MariaDB with cleartext password storage.

There are no specific detection commands or network signatures provided in the available resources. However, you can check the SOGo version installed on your system to determine if it is vulnerable.

  • Check SOGo version: Run `sogo-tool --version` or check the package version via your package manager.
  • Review logs for unusual SQL errors or suspicious password change attempts.
  • Monitor database queries for unexpected or malformed SQL statements targeting the password change functionality.
Mitigation Strategies

The immediate and recommended mitigation step is to upgrade SOGo to version 5.12.7 or later, where this SQL injection vulnerability has been fixed.

If upgrading immediately is not possible, consider restricting access to the password change functionality to trusted users only and monitor for suspicious activity.

Additionally, if your system uses MariaDB or PostgreSQL with cleartext password storage, consider encrypting stored passwords to reduce risk.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-39179. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart