GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
usn-8504-1
Vulnerability from osv_ubuntu
Published
2026-07-05 23:01
Modified
2026-07-05 23:01
Summary
sogo vulnerabilities
Details

It was discovered that SOGo did not properly sanitize categories used for events, tasks, and contacts. A remote authenticated attacker could possibly use this issue to perform cross-site scripting attacks. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 26.04 LTS. (CVE-2025-71276)

It was discovered that SOGo did not properly sanitize the hint query parameter. A remote attacker could possibly use this issue to perform cross-site scripting attacks. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-3054)

It was discovered that SOGo did not renew the one-time password when a user disabled and re-enabled it, and used a shorter length than recommended. A remote attacker could possibly use this issue to bypass authentication. This issue only affected Ubuntu 22.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-33550)

It was discovered that SOGo did not properly use the SQL adaptor for the user source, resulting in SQL injection when certain databases were used. A remote authenticated attacker could possibly use this issue to obtain sensitive information or execute arbitrary SQL commands. (CVE-2026-46445, CVE-2026-46446)

It was discovered that SOGo did not properly sanitize mail containing ICS calendar invitations. A remote attacker could possibly use this issue to perform cross-site scripting attacks. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-8496)

It was discovered that SOGo did not properly validate identifiers when managing access control lists. A remote authenticated attacker could possibly use this issue to perform SQL injection attacks and obtain sensitive information. (CVE-2026-8851)

It was discovered that SOGo did not properly sanitize the theme parameter. A remote attacker could possibly use this issue to perform cross-site scripting attacks. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2025-63499)

It was discovered that SOGo did not properly sanitize the userName parameter on the login page. A remote attacker could possibly use this issue to perform cross-site scripting attacks. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2025-63498)

It was discovered that SOGo did not properly sanitize attachments when previewing them. A remote attacker could possibly use this issue to perform cross-site scripting attacks. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2024-34462)

It was discovered that SOGo did not validate the signatures of SAML assertions it received when SAML was used for authentication. A remote attacker could possibly use this issue to impersonate other users. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-33054)

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2021-33054",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-34462",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-63498",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8851",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-46445",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-46446",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "sogo",
            "binary_version": "2.2.17a-1.1ubuntu0.1~esm1"
          },
          {
            "binary_name": "sogo-common",
            "binary_version": "2.2.17a-1.1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "sogo",
        "purl": "pkg:deb/ubuntu/sogo@2.2.17a-1.1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.17a-1.1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.2.17a-1",
        "2.2.17a-1.1",
        "2.2.17a-1.1build1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2021-33054",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-34462",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-63498",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-63499",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-71276",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8851",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-46445",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-46446",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "sogo",
            "binary_version": "3.2.10-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "sogo-common",
            "binary_version": "3.2.10-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "sogo",
        "purl": "pkg:deb/ubuntu/sogo@3.2.10-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.10-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.2.10-1",
        "3.2.10-1build1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2021-33054",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-34462",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-63498",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-63499",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-71276",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8851",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-46445",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-46446",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "sogo",
            "binary_version": "4.3.0-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "sogo-common",
            "binary_version": "4.3.0-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "sogo",
        "purl": "pkg:deb/ubuntu/sogo@4.3.0-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.3.0-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.0.8-1",
        "4.1.0-1",
        "4.1.1-1",
        "4.3.0-1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-34462",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-63498",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-63499",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-71276",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8851",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-33550",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-46445",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-46446",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "sogo",
            "binary_version": "5.5.1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "sogo-activesync",
            "binary_version": "5.5.1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "sogo-common",
            "binary_version": "5.5.1-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "sogo",
        "purl": "pkg:deb/ubuntu/sogo@5.5.1-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.5.1-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.1.0-1",
        "5.2.0-1",
        "5.2.0-3",
        "5.3.0-1",
        "5.3.0-1build2",
        "5.4.0-1",
        "5.5.0-1",
        "5.5.1-1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2025-71276",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-3054",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8496",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-8851",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                  "type": "CVSS_V4"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-33550",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-46445",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2026-46446",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:26.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "sogo",
            "binary_version": "5.12.4-1.2ubuntu0.1~esm1"
          },
          {
            "binary_name": "sogo-activesync",
            "binary_version": "5.12.4-1.2ubuntu0.1~esm1"
          },
          {
            "binary_name": "sogo-common",
            "binary_version": "5.12.4-1.2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:26.04:LTS",
        "name": "sogo",
        "purl": "pkg:deb/ubuntu/sogo@5.12.4-1.2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.12.4-1.2ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.12.1-3",
        "5.12.4-1",
        "5.12.4-1.1",
        "5.12.4-1.2"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that SOGo did not properly sanitize categories used\nfor events, tasks, and contacts. A remote authenticated attacker could\npossibly use this issue to perform cross-site scripting attacks. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04\nLTS, and Ubuntu 26.04 LTS. (CVE-2025-71276)\n\nIt was discovered that SOGo did not properly sanitize the hint query\nparameter. A remote attacker could possibly use this issue to perform\ncross-site scripting attacks. This issue only affected Ubuntu 26.04\nLTS. (CVE-2026-3054)\n\nIt was discovered that SOGo did not renew the one-time password when a\nuser disabled and re-enabled it, and used a shorter length than\nrecommended. A remote attacker could possibly use this issue to bypass\nauthentication. This issue only affected Ubuntu 22.04 LTS and Ubuntu\n26.04 LTS. (CVE-2026-33550)\n\nIt was discovered that SOGo did not properly use the SQL adaptor for\nthe user source, resulting in SQL injection when certain databases\nwere used. A remote authenticated attacker could possibly use this\nissue to obtain sensitive information or execute arbitrary SQL\ncommands. (CVE-2026-46445, CVE-2026-46446)\n\nIt was discovered that SOGo did not properly sanitize mail containing\nICS calendar invitations. A remote attacker could possibly use this\nissue to perform cross-site scripting attacks. This issue only\naffected Ubuntu 26.04 LTS. (CVE-2026-8496)\n\nIt was discovered that SOGo did not properly validate identifiers when\nmanaging access control lists. A remote authenticated attacker could\npossibly use this issue to perform SQL injection attacks and obtain\nsensitive information. (CVE-2026-8851)\n\nIt was discovered that SOGo did not properly sanitize the theme\nparameter. A remote attacker could possibly use this issue to perform\ncross-site scripting attacks. This issue only affected Ubuntu 18.04\nLTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2025-63499)\n\nIt was discovered that SOGo did not properly sanitize the userName\nparameter on the login page. A remote attacker could possibly use this\nissue to perform cross-site scripting attacks. This issue only\naffected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and\nUbuntu 22.04 LTS. (CVE-2025-63498)\n\nIt was discovered that SOGo did not properly sanitize attachments when\npreviewing them. A remote attacker could possibly use this issue to\nperform cross-site scripting attacks. This issue only affected Ubuntu\n16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.\n(CVE-2024-34462)\n\nIt was discovered that SOGo did not validate the signatures of SAML\nassertions it received when SAML was used for authentication. A remote\nattacker could possibly use this issue to impersonate other users.\nThis issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and\nUbuntu 20.04 LTS. (CVE-2021-33054)",
  "id": "USN-8504-1",
  "modified": "2026-07-05T23:01:31Z",
  "published": "2026-07-05T23:01:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8504-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-33054"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-34462"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-63498"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-63499"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-71276"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-3054"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-8496"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-8851"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-33550"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-46445"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-46446"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "sogo vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2021-33054",
    "UBUNTU-CVE-2024-34462",
    "UBUNTU-CVE-2025-63498",
    "UBUNTU-CVE-2025-63499",
    "UBUNTU-CVE-2025-71276",
    "UBUNTU-CVE-2026-3054",
    "UBUNTU-CVE-2026-8496",
    "UBUNTU-CVE-2026-8851",
    "UBUNTU-CVE-2026-33550",
    "UBUNTU-CVE-2026-46445",
    "UBUNTU-CVE-2026-46446"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.