SOGo Email Application Vulnerability Allows Sieve Script Injection by Users
CVE-2026-127135

5.3MEDIUM

Key Information:

Vendor

Alinto

Status
Sogo
Vendor
CVE Published:
12 November 2026

What is CVE-2026-127135?

SOGo versions prior to 5.12.13 are vulnerable to Sieve script injection, enabling authenticated users to manipulate notification address values. By inserting unescaped values, users can introduce arbitrary Sieve directives, allowing malicious actions such as redirecting or discarding incoming emails. This vulnerability facilitates the circumvention of administrator-configured forwarding-domain constraints, posing significant risks to email security.

Affected Version(s)

sogo 0 < 5.12.13

References

https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13
patchrelease-notes
https://www.vulncheck.com/advisories/sogo-before-sieve-sc...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Richard OlszynskĂ˝
.