CVE-2026-127121: SOGo before 5.12.13 S/MIME Certificate Spoofing via UIxMailView
SOGo before 5.12.13 contains an improper cryptographic signature verification vulnerability that allows remote attackers to replace a victim's contact S/MIME certificate by sending a spoofed multipart/signed message with a mismatched signature and an impersonated From address. Attackers can deliver a crafted CMS signedData object containing their own self-signed certificate, which SOGo's UIxMailView stores on the contact card without validating signature authenticity or certificate identity, enabling subsequent encrypted communications to be decrypted with the attacker's private key.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SOGoto a version that resolves this vulnerability.Fixed in 5.12.13
Event History
Frequently Asked Questions
Who is exposed to this issue?
SOGo deployments running versions before 5.12.13 are affected. The issue applies where S/MIME certificates from received signed messages can be stored on contact cards through UIxMailView.
What does an attacker need to exploit it?
An attacker can act remotely without privileges, but must convince the victim to interact with a crafted multipart/signed email. The message uses an impersonated From address and a CMS signedData object containing the attacker’s self-signed certificate.
What is the impact after successful exploitation?
The attacker’s certificate can replace the certificate stored for a victim contact. Later messages encrypted to that contact may be encrypted with the attacker’s certificate, allowing the attacker to decrypt them using the corresponding private key.
How can this be remediated?
Upgrade SOGo to version 5.12.13 or later. The provided data does not identify a workaround for deployments that cannot immediately upgrade.