CVE-2026-46445: High-Severity SQL Injection Impacts SOGo with PostgreSQL

The National Vulnerability Database has disclosed CVE-2026-46445, a high-severity SQL injection vulnerability affecting SOGo before version 5.12.7, specifically when configured with a PostgreSQL backend. This flaw, categorized under CWE-89, carries a CVSSv3.1 score of 7.1 (High), indicating a significant risk profile. Attackers could leverage this vulnerability to execute arbitrary SQL commands, potentially leading to data exfiltration, modification, or even complete system compromise.

The attacker’s calculus here is straightforward: SOGo is often deployed in critical enterprise environments for calendaring and groupware. A successful SQL injection grants deep access to sensitive information within the database, which can be highly valuable for reconnaissance, lateral movement, or direct data theft. The AC:H (High Attack Complexity) suggests that exploiting this isn’t trivial, but it’s far from impossible for a determined adversary with some technical skill and understanding of SOGo’s architecture.

Defenders must prioritize patching. SOGo version 5.12.7 addresses this vulnerability. Organizations running affected SOGo instances with PostgreSQL databases are exposed. This isn’t just about data loss; it’s about maintaining integrity and availability of critical communication infrastructure. Failure to patch leaves a significant backdoor open in a system often considered internal and trusted.