SOGo contains a SQL injection defect in its password‑change API that is triggered by submitting a malicious value to the newPassword field. The application fails to escape the input, allowing injection statements. Based on the description, it is inferred that this flaw directly threatens data confidentiality and integrity by permitting the attacker to delete database entries or alter data, and is classified as CWE‑89.

Versions of SOGo older than 5.12.7 are affected. Any installation running such a version, regardless of vendor, is vulnerable when the user is authenticated. 5.12.7 addresses the issue, so deployments should verify their current sogo version and upgrade if necessary.

Based on the description, it is inferred that the exploit requires prior authentication, so credential compromise is a precondition. Once authenticated, the attacker can execute the injected SQL, potentially leading to data theft, corruption, or disruption of service. The CVSS score of 6.3 indicates moderate severity. Based on the EPSS score of less than 1%, it is inferred that exploitation is currently unlikely, and the absence of a KEV listing further supports this assessment. However, the high impact warrants timely remediation.