CVE-2026-46446: Alinto Sogo

High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days.

SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.

Affected products

• Alinto Sogo: before 5.12.7 (fixed in 5.12.7)

Published 2026-05-14. Last modified 2026-06-17.