CVE-2026-8851: SOGo SQL Injection Exposes Database Data

The National Vulnerability Database (NVD) has detailed CVE-2026-8851, a high-severity SQL injection vulnerability impacting SOGo 5.12.7. This flaw resides within the Access Control List (ACL) management functionality. Authenticated users can exploit this by injecting SQL subqueries via the uid parameter in the addUserInAcls endpoint.

Attackers can leverage this vulnerability to extract arbitrary data from the database. Critically, the NVD notes that malicious SQL code can be injected to write this extracted data into the sogo_acl table. This establishes an out-of-band data exfiltration channel, allowing attackers to retrieve the stolen information through the /acls API. The CVSSv3.1 score is 8.1 (HIGH), signaling significant risk due to high confidentiality and integrity impacts without requiring complex attack conditions.

This isn’t just a data leak; it’s a controlled data exfiltration mechanism. An attacker who gains authenticated access — perhaps through stolen credentials or another initial compromise — can systematically siphon off sensitive information, effectively bypassing standard monitoring if not specifically looking for these API calls. Defenders need to recognize the dual threat here: initial database compromise and then the stealthy exfiltration channel.