CVE-2026-127135

MEDIUM 4.3

SOGo before 5.12.13 Sieve Script Injection via Notification Address

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

SOGo before 5.12.13 contains a Sieve script injection vulnerability that allows authenticated users to inject arbitrary Sieve directives by inserting unescaped notification address values into a generated Sieve script. Attackers can embed Sieve redirect or discard statements within the notificationAddress preference to bypass the administrator-configured forwarding-domain constraint and redirect or discard incoming mail.

CWE	CWE-96
Vendor	alinto
Product	sogo
Published	Nov 12, 2026

Stay Ahead of the Next One

Get instant alerts for alinto sogo

Be the first to know when new medium vulnerabilities affecting alinto sogo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

Alinto / sogo

0 < 5.12.13

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13 vulncheck.com: https://www.vulncheck.com/advisories/sogo-before-sieve-script-injection-via-notification-address

Credits

Richard Olszynský