SOGo contains a SQL injection flaw in the password‑change API that is triggered by supplying a malicious value to the newPassword field. When an authenticated user submits the crafted value, the application fails to properly escape the input, allowing the attacker to inject arbitrary SQL statements. The flaw directly impacts data confidentiality and integrity, giving the attacker the ability to read, modify, or delete database records. The vulnerability is of type CWE‑89, the classic SQL injection weakness.

Any SOGo deployment running a version earlier than 5.12.7 is vulnerable. The vendor has released version 5.12.7 to mitigate the issue; therefore, installations using 5.12.6 or earlier must be identified and upgraded or otherwise protected. No other vendors or products are reported to be affected.

The attack requires that the user already be authenticated, so credential compromise is a prerequisite. Once authenticated, the attacker can execute the injected SQL, potentially causing data theft, corruption, or disabling the system. The CVSS score of 6.3 indicates moderate severity, and the EPSS score of <1% and the absence of a KEV listing suggest that exploitation is currently unlikely. Nevertheless, because of the high consequence of malformed SQL on the database, the vulnerability warrants prompt remediation.