CVE-2026-127145

CVSS 5.3 (medium) · published 2026-11-12

SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server's position.

Weakness: CWE-918

Source: NVD CVE-2026-127145

References

• https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13
• https://www.vulncheck.com/advisories/sogo-before-ssrf-via-web-calendar-subscriptions

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.