SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8504-1 advisory.

    It was discovered that SOGo did not properly sanitize categories used for events, tasks, and contacts. A     remote authenticated attacker could possibly use this issue to perform cross-site scripting attacks. This     issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 26.04 LTS.
    (CVE-2025-71276)

    It was discovered that SOGo did not properly sanitize the hint query parameter. A remote attacker could     possibly use this issue to perform cross-site scripting attacks. This issue only affected Ubuntu 26.04     LTS. (CVE-2026-3054)

    It was discovered that SOGo did not renew the one-time password when a user disabled and re-enabled it,     and used a shorter length than recommended. A remote attacker could possibly use this issue to bypass     authentication. This issue only affected Ubuntu 22.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-33550)

    It was discovered that SOGo did not properly use the SQL adaptor for the user source, resulting in SQL     injection when certain databases were used. A remote authenticated attacker could possibly use this issue     to obtain sensitive information or execute arbitrary SQL commands. (CVE-2026-46445, CVE-2026-46446)

    It was discovered that SOGo did not properly sanitize mail containing ICS calendar invitations. A remote     attacker could possibly use this issue to perform cross-site scripting attacks. This issue only affected     Ubuntu 26.04 LTS. (CVE-2026-8496)

    It was discovered that SOGo did not properly validate identifiers when managing access control lists. A     remote authenticated attacker could possibly use this issue to perform SQL injection attacks and obtain     sensitive information. (CVE-2026-8851)

    It was discovered that SOGo did not properly sanitize the theme parameter. A remote attacker could     possibly use this issue to perform cross-site scripting attacks. This issue only affected Ubuntu 18.04     LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2025-63499)

    It was discovered that SOGo did not properly sanitize the userName parameter on the login page. A remote     attacker could possibly use this issue to perform cross-site scripting attacks. This issue only affected     Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2025-63498)

    It was discovered that SOGo did not properly sanitize attachments when previewing them. A remote attacker     could possibly use this issue to perform cross-site scripting attacks. This issue only affected Ubuntu     16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2024-34462)

    It was discovered that SOGo did not validate the signatures of SAML assertions it received when SAML was     used for authentication. A remote attacker could possibly use this issue to impersonate other users. This     issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-33054)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4657 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4657-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     June 29, 2026                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : sogo     Version        : 5.8.0-2+deb12u3     CVE IDs        : CVE-2026-46445 CVE-2026-46446 CVE-2025-71276                      CVE-2026-33550 CVE-2026-8496 CVE-2026-8851     Debian Bugs    : 1131605 1131606

    Multiple vulnerabilities were discovered in sogo, the open-source     webmail and groupware server:

    * CVE-2026-46445: A SQL injection vulnerability when PostgreSQL is       used as the user database.

    * CVE-2026-46446: Address a SQL injection vulnerability when MariaDB       or PostgreSQL is used as the user database and passwords are       stored in cleartext.

    * CVE-2025-71276: Fix a A Cross-Site Scripting (XSS) vulnerability in       events, tasks and contacts categories.

    * CVE-2026-33550: Address a number of Time-Based One-Time Passwords       (TOTP) vulnerabilities, including if a user disables/enables TOTP,       various values not being renewed, and an issue around recommended       TOTP lengths.

    * CVE-2026-8496: Fix an issue where a maliciously crafted .ICS       calendar invitation file allowed arbitrary JavaScript execution       within an authenticated webmail session.

    * CVE-2026-8851: Fix an SQL injection vulnerability in the access       control list management functionality, which could have allowed       authenticated users to extract arbitrary data from the database by       injecting SQL subqueries through the uid parameter of the       addUserInAcls endpoint.

    In addition, a patch was added to fix a Cross-Site Scripting (XSS)     vulnerability in message subject rendering.

    For Debian 11 bullseye, these problem have been fixed in version     5.8.0-2+deb12u3.

    We recommend that you upgrade your sogo packages.

    Thank you to Peter Wienemann <wiene@debian.org> for preparing this     update.

    For the detailed security status of sogo please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/sogo

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6366 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6366-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 25, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : sogo     CVE ID         : CVE-2025-71276 CVE-2026-3054 CVE-2026-8496 CVE-2026-8851                      CVE-2026-33550 CVE-2026-46445 CVE-2026-46446

    Multiple security vulnerabilities were discovered in the SOGo groupware     server, which could result in cross-site scripting or SQL injection.

    For the stable distribution (trixie), these problems have been fixed in     version 5.12.1-3+deb13u2.

    We recommend that you upgrade your sogo packages.

    For the detailed security status of sogo please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/sogo

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL     injection. This is related to c_password = '%@' in changePasswordForLogin. (CVE-2026-46446)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
325422	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 26.04 LTS : SOGo vulnerabilities (USN-8504-1)	Nessus	Ubuntu Local Security Checks	high
323707	Debian dla-4657 : sogo - security update	Nessus	Debian Local Security Checks	high
323061	Debian dsa-6366 : sogo - security update	Nessus	Debian Local Security Checks	high
314733	Linux Distros Unpatched Vulnerability : CVE-2026-46446	Nessus	Misc.	high

Detections

Analytics

CVE-2026-46446

high

Tenable Plugins

high

high

high

high