CVE-2026-127135: SOGo before 5.12.13 Sieve Script Injection via Notification Address
SOGo before 5.12.13 contains a Sieve script injection vulnerability th ...
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/sogoto a version that resolves this vulnerability.Fixed in 5.12.13-1 - Upgrade
Upgrade
SOGoto a version that resolves this vulnerability.Fixed in 5.12.13
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated SOGo user who can set the notificationAddress preference can exploit it. No user interaction is required.
What is the practical impact?
An attacker can inject Sieve directives such as redirect or discard into a generated script. This can bypass the administrator-configured forwarding-domain constraint, allowing incoming mail to be redirected or discarded.
Are deployments running version 5.12.13 affected?
The issue affects SOGo versions before 5.12.13. The provided information identifies 5.12.13 as the release containing the fix.
What can be done if updating is not immediately possible?
The provided information does not specify a workaround. Restricting access to accounts that can modify the notificationAddress preference may reduce exposure, but this is not documented as a complete mitigation.