Home

Description

SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.

PUBLISHED Reserved 2026-05-14 | Published 2026-05-14 | Updated 2026-05-14 | Assigner mitre




HIGH: 7.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status
unaffected

Any version before 5.12.7
affected

References

www.sogo.nu/news/2026/sogo-v5127-released.html

github.com/...anges/1f7e5d2b2c2047c44a6a9e05f73c36491cb96d21

www.mail-archive.com/...ist@lists.debian.org/msg2100131.html

cve.org (CVE-2026-46446)

nvd.nist.gov (CVE-2026-46446)

Download JSON