CVE-2026-8851 SOGo < 5.12.8 SQL Injection via addUserInAcls endpoint
Authenticated attackers can inject SQL via the addUserInAcls endpoint to exfiltrate arbitrary database data from SOGo Webmail.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8851?
CVE-2026-8851 is a high-severity SQL injection vulnerability in Alinto SOGo Webmail, published on 18 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can inject malicious SQL code to write extracted data into the sogo_acl table and retrieve it through the /acls API, establishing an out-of-band data exfiltration channel.
Weakness: CWE-89
Which versions are affected by CVE-2026-8851?
How do I fix CVE-2026-8851?
Upgrade to a fixed version.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-8851 being exploited?
There is no known exploitation of CVE-2026-8851 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-8851, GHSA-7vv4-j48f-wcx7, UBUNTU-CVE-2026-8851.