CVE-2026-39178: SQL Injection in SOGo allContactSearch – Patch to 5.12.7

Technical summary

CVE-2026-39178 is a CWE-89 SQL injection vulnerability in the allContactSearch endpoint of SOGo. The flaw exists in improper input sanitization of the search parameter, allowing authenticated users to break out of intended SQL queries and execute attacker-controlled statements against the backend database. The vulnerability carries a CVSS 3.1 score of 6.3 (MEDIUM severity) with a network attack vector, low complexity, and requiring low privileges, affecting confidentiality, integrity, and availability equally.

Business impact

Exploitation enables unauthorized access to contact information and user data stored in SOGo's database. Attackers with valid credentials—whether from internal compromise or credential theft—can exfiltrate sensitive contacts, modify or delete records, or disrupt service availability. For organizations relying on SOGo for email and calendar management, this could expose customer lists, internal communications metadata, or personally identifiable information (PII) depending on stored content and downstream integrations.

Affected systems

SOGo versions prior to 5.12.7 are affected. The vulnerability requires authentication, limiting the attack surface to users with valid SOGo accounts. Organizations running self-hosted SOGo deployments or cloud instances should verify their current version against the 5.12.7 release threshold.

Exploitability

This vulnerability has a low barrier to exploitation for authenticated users. No exploit has been reported in the wild, and the vulnerability is not listed on CISA's KEV catalog. However, the low complexity and network accessibility mean that once an attacker gains valid credentials—through phishing, insider access, or credential reuse—they can readily craft SQL injection payloads without specialized tools or deep technical knowledge.

Remediation

Upgrade SOGo to version 5.12.7 or later. This patch release addresses the input validation flaw in the allContactSearch endpoint. Organizations should verify patch application in test environments first, particularly for production groupware systems where continuity is critical.

Patch guidance

Obtain and deploy SOGo 5.12.7 or later from the official SOGo project repository or your distribution vendor. Follow standard change management practices: test the patch in a non-production environment, schedule downtime if required, back up configuration and data, and validate contact search and other groupware functions post-deployment. Document the patch version applied for compliance tracking.

Detection guidance

Monitor for SQL error messages or unusual database activity from SOGo processes, particularly around the allContactSearch endpoint. Review application logs for malformed or unexpected search parameters containing SQL metacharacters (single quotes, semicolons, UNION keywords, etc.). Network-level detection can flag outbound database connections with suspicious query patterns from the SOGo application server. Implement input validation logging if available in SOGo configuration.

Why prioritize this

Despite MEDIUM severity, this vulnerability merits prompt attention because it directly compromises contact data—often business-critical and sensitive—and affects integrity as well as confidentiality. The low attack complexity and authentication-only requirement mean a compromised user account or insider threat becomes a direct path to database manipulation. Organizations with strict data protection obligations (GDPR, HIPAA, etc.) should treat this with elevated urgency.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects the balance between limited scope (MEDIUM severity) and real impact. A network-accessible endpoint combined with low complexity and low privilege requirements would suggest higher risk, but the authentication requirement and limited scope (confidentiality, integrity, and availability each partially affected) moderate the score to MEDIUM. For organizations where SOGo holds sensitive contact or PII data, effective risk may be materially higher than the base score suggests.

Frequently asked questions