CVE-2026-127145: SOGo before 5.12.13 SSRF via Web Calendar Subscriptions
SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server's position.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated SOGo user can exploit it. The attacker needs access to the Calendar/addWebCalendar endpoint and the ability to trigger a reload of the subscribed calendar.
What can an attacker do with this vulnerability?
The attacker can cause the SOGo server to connect to arbitrary internal host and port destinations. They can use observable outcomes, including connection failures, timeouts, authentication prompts, and invalid content, to probe services reachable from the server.
Which versions are affected?
SOGo versions before 5.12.13 are affected. Version 5.12.13 is identified as the release containing the fix.
How can I tell whether exploitation may have occurred?
Review activity involving Calendar/addWebCalendar and calendar reload requests for user-controlled URLs targeting internal hosts or unusual ports. Repeated requests that produce differing connection, timeout, authentication, or content-related outcomes may indicate internal service probing.