PT-2026-48585 · Inverse+3 · Sogo

CVE-2026-39179

·

Published

2026-03-26

·

Updated

2026-07-09

CVSS v2.0

10

High

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions SOGo versions prior to 5.12.7
Description An issue exists in the password change functionality and the contact search component where SQL query structures are not properly protected. This allows authenticated users to execute arbitrary SQL statements via the newPassword parameter. Such exploitation could enable a remote attacker to execute arbitrary code or gain unauthorized access to protected information.
Recommendations Update to version 5.12.7 or later.

Exploit

Fix

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2026-07862
CVE-2026-39179

Affected Products

Sogo