PT-2026-40847
CVE-2026-46446
·
Published
2026-05-14
·
Updated
2026-10-01
Description by
CVSS 3.1
7.1
HighMetricsAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Name of the Vulnerable Software and Affected Versions
SOGo versions prior to 5.12.7
Description
An issue exists when PostgreSQL or MariaDB is used and cleartext passwords are stored, allowing SQL injection. This occurs due to the use of
c password = '%@' within the changePasswordForLogin() function.Recommendations
Update to version 5.12.7 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾