CVE-2026-127121

CVSS 7.1 (high) · published 2026-11-12

SOGo before 5.12.13 contains an improper cryptographic signature verification vulnerability that allows remote attackers to replace a victim's contact S/MIME certificate by sending a spoofed multipart/signed message with a mismatched signature and an impersonated From address. Attackers can deliver a crafted CMS signedData object containing their own self-signed certificate, which SOGo's UIxMailView stores on the contact card without validating signature authenticity or certificate identity, enabling subsequent encrypted communications to be decrypted with the attacker's private key.

Weakness: CWE-347

Source: NVD CVE-2026-127121

References

• https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13
• https://www.vulncheck.com/advisories/sogo-before-s-mime-certificate-spoofing-via-uixmailview

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.