CVE-2026-127135 · Other
NO FIX YET · SEE WHAT TO DO
SOGo before 5.12.13 does not escape notification address values written into generated Sieve mail filter scripts. An authenticated user can insert Sieve redirect or discard statements that bypass the forwarding-domain restriction and redirect or drop incoming mail.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Organizations running SOGo groupware with user-editable notification address settings and Sieve filtering enabled. Deployments without these features, or where users cannot edit notification addresses, are less exposed. The sources do not give more detail on the exact configuration.
Not affected if no-user-notification-settings, sieve-disabled
Who cares mail, self-hosted, sieve, sogo
5.12.13 or laterSOGo before 5.12.13 contains a Sieve script injection vulnerability that allows authenticated users to inject arbitrary Sieve directives by inserting unescaped notification address values into a generated Sieve script. Attackers can embed Sieve redirect or discard statements within the notificationAddress preference to bypass the administrator-configured forwarding-domain constraint and redirect or discard incoming mail.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.