SOGo 5.12.7 has a flaw in the ACL management feature that lets a logged‑in user inject arbitrary SQL through the uid parameter of the addUserInAcls endpoint. With this injection the attacker can read any data from the database and also write data into the sogo_acl table. The attacker can then retrieve the injected data through the /acls API, creating an out‑of‑band channel to exfiltrate information. This weakness is a classic instance of an uncontrolled user‑supplied value leading to SQL code execution, classified as CWE‑89.

The vulnerable product is Alinto SOGo Webmail, version 5.12.7. The vendor has released version 5.12.8 that contains a fix for the issue; upgrading to that or later is recommended.

The CVSS score is 8.6, indicating high severity. The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated session; attackers need valid credentials with ACL management rights. The attack path is within the web application’s ACL subsystem, so it is limited to the application layer. Given the confirmed ability to read and write data via SQL injection, the risk of unauthorized data exposure remains high and should be mitigated promptly.