CVE-2026-39178

Name of the Vulnerable Software and Affected Versions SOGo versions prior to 5.12.7

Description An issue exists in the contact search component where the software fails to properly protect the SQL query structure. This allows authenticated users to execute arbitrary SQL statements through the search parameter of the 'allContactSearch' endpoint. Such exploitation could enable a remote attacker to execute arbitrary code or gain unauthorized access to protected information.

Recommendations Update to version 5.12.7 or later. As a temporary mitigation, restrict access to the 'allContactSearch' endpoint or avoid using the search parameter until the update is applied.