Skip to content
OpenAdvisories

Product · Alinto

SOGo

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.4
    CVE-2026-127131

    SOGo before 5.12.13 Missing Rate Limiting on TOTP Verification

    SOGo before 5.12.13 contains a missing rate limiting vulnerability in its web login TOTP verification that allows attackers who already possess a victim's password to brute-force the second-factor code without triggering any lockout. Attackers can send repeat…

    Alinto SOGo sogo sogo Debian Ubuntu
  • High 7.4
    CVE-2026-127111

    SOGo before 5.12.13 Unauthenticated Password Recovery Brute Force

    SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint with…

    Alinto SOGo sogo sogo Debian Ubuntu
  • High 8.3
    CVE-2026-93453 Public exploit

    SOGo before 5.12.11 Password Reset Token Interception via Origin Header

    SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a…

    Alinto SOGo sogo sogo Debian Ubuntu
  • High 7.1
    CVE-2026-46446

    SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This …

    Alinto SOGo sogo sogo Debian Ubuntu
  • High 7.1
    CVE-2026-46445

    SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.

    Alinto SOGo sogo sogo Debian Ubuntu