Server-Side Request Forgery in SOGo by Alinto

CVE-2026-127145

What is CVE-2026-127145?

SOGo prior to version 5.12.13 is susceptible to a server-side request forgery vulnerability. This issue allows authenticated users to manipulate the server into connecting to arbitrary internal host:port destinations through a user-defined URL in the Calendar/addWebCalendar endpoint. By exploiting this flaw, an attacker can initiate a reload of subscribed web calendars, enabling them to determine response behaviors such as timeouts and connection failures. This interaction allows the attacker to glean insights about the internal network infrastructure from the server's vantage point, heightening the risk of further exploitation.

References