CVE-2026-127145

medium

Description

SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server's position.

References

https://www.vulncheck.com/advisories/sogo-before-ssrf-via-web-calendar-subscriptions

https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124534

Details

Source: Mitre, NVD

Published: 2026-11-12

Updated: 2026-11-13

Risk Information

CVSS v2

Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 4.3

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Severity: Medium

CVSS v4

Base Score: 5.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.0029