CVE-2026-8851: SOGo < 5.12.8 SQL Injection via addUserInAcls endpoint
Last updated 6 July 2026
Other sources
SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can inject malicious SQL code to write extracted data into the sogoacl table and retrieve it through the /acls API, establishing an out-of-band data exfiltration channel.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/sogoto a version that resolves this vulnerability.Fixed in 5.8.0-2+deb12u3Fixed in 5.12.1-3+deb13u2Fixed in 5.12.9-1 - Upgrade
Upgrade
SOGoto a version that resolves this vulnerability.Fixed in 5.12.8 - Compensating control
Restrict access to the SOGo /acls API (and related ACL management endpoints like addUserInAcls) so only authorized users can reach it, reducing the ability of authenticated attackers to exploit the SQL injection.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8851?
CVE-2026-8851 has a severity rating of 8.6, indicating a high-risk vulnerability.
How do I fix CVE-2026-8851?
To mitigate CVE-2026-8851, upgrade SOGo to version 5.12.8 or later.
What type of vulnerability is CVE-2026-8851?
CVE-2026-8851 is a SQL injection vulnerability found in the Access Control List management feature.
Who can exploit CVE-2026-8851?
CVE-2026-8851 can be exploited by authenticated users who have access to the addUserInAcls endpoint.
What impact does CVE-2026-8851 have on my data?
CVE-2026-8851 allows attackers to extract arbitrary data from the database, compromising data confidentiality and integrity.