{"id":"CVE-2026-127135","kind":"vulnerability","aliases":["CVE-2026-127135"],"related":[],"title":"SOGo: Sieve script injection lets users redirect or discard incoming mail","description":"SOGo before 5.12.13 contains a Sieve script injection vulnerability that allows authenticated users to inject arbitrary Sieve directives by inserting unescaped notification address values into a generated Sieve script. Attackers can embed Sieve redirect or discard statements within the notificationAddress preference to bypass the administrator-configured forwarding-domain constraint and redirect or discard incoming mail.","summary":"SOGo before 5.12.13 does not escape notification address values written into generated Sieve mail filter scripts. An authenticated user can insert Sieve redirect or discard statements that bypass the forwarding-domain restriction and redirect or drop incoming mail.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mail","other","self-hosted","sieve","sogo"],"not_affected_if":["no-user-notification-settings","sieve-disabled"],"how_to_check":"- Check the installed SOGo version against the fixed release in the product ranges (unknown if not given)\n- Review whether the notificationAddress preference is enabled for users and whether the administrator sets a forwarding-domain constraint","fix":"- SOGo: move to `5.12.13` or later","status":"open","published_at":"2026-11-12T16:19:08+00:00","first_seen_at":"2026-11-12T16:44:02+00:00","triaged_at":"2026-11-12T16:45:46+00:00","updated_at":"2026-11-12T16:45:46+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-12T16:45:46Z","model":"claude-haiku-5-5","output":{"fix":"- SOGo: move to `5.12.13` or later","reach":"network","title":"SOGo: Sieve script injection lets users redirect or discard incoming mail","impact":"medium","summary":"SOGo before 5.12.13 does not escape notification address values written into generated Sieve mail filter scripts. An authenticated user can insert Sieve redirect or discard statements that bypass the forwarding-domain restriction and redirect or drop incoming mail.","audience":"businesses","category":"other","nicknames":[],"who_cares":["sogo","sieve","mail","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker silently redirects or discards other users' incoming mail","analyst_note":"Confirm whether the fixed version is named in the release notes at github.com.\n","how_to_check":"- Check the installed SOGo version against the fixed release in the product ranges (unknown if not given)\n- Review whether the notificationAddress preference is enabled for users and whether the administrator sets a forwarding-domain constraint","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["sieve-disabled","no-user-notification-settings"],"who_is_affected":"Organizations running SOGo groupware with user-editable notification address settings and Sieve filtering enabled. Deployments without these features, or where users cannot edit notification addresses, are less exposed. The sources do not give more detail on the exact configuration.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000733,"input_tokens":4624,"output_tokens":542,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-127135':14A,17A '-2026':13A,16A '5.12.13':27B,66C 'address':32B,86C 'administr':109C 'administrator-configur':108C 'allow':74C 'arbitrari':79C 'attack':93C 'authent':42B,75C 'bypass':52B,106C 'configur':110C 'constraint':114C 'contain':67C 'cve':12A,15A 'direct':81C 'discard':9A,49B,99C,118C 'domain':56B,113C 'drop':61B 'emb':95C 'escap':30B 'filter':39B 'forward':55B,112C 'forwarding-domain':54B,111C 'generat':36B,90C 'host':22B 'incom':10A,62B,119C 'inject':4A,71C,78C 'insert':45B,83C 'let':5A 'mail':11A,18B,38B,63B,120C 'notif':31B,85C 'notificationaddress':103C 'prefer':104C 'redirect':7A,47B,59B,97C,116C 'restrict':57B 'script':3A,40B,70C,92C 'self':21B 'self-host':20B 'siev':2A,23B,37B,46B,69C,80C,91C,96C 'sogo':1A,24B,25B,64C 'statement':50B,100C 'unescap':84C 'user':6A,43B,76C 'valu':33B,87C 'vulner':72C 'within':101C 'written':34B","nicknames":[],"mitigations":[],"who_affected":"Organizations running SOGo groupware with user-editable notification address settings and Sieve filtering enabled. Deployments without these features, or where users cannot edit notification addresses, are less exposed. The sources do not give more detail on the exact configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["mail","medium","other","selfhosted","sieve","sogo"],"campaign_type":null,"search_a":"'-127135':14A,17A '-2026':13A,16A 'cve':12A,15A 'discard':9A 'incom':10A 'inject':4A 'let':5A 'mail':11A 'redirect':7A 'script':3A 'siev':2A 'sogo':1A 'user':6A","search_b":"'5.12.13':27B 'address':32B 'authent':42B 'bypass':52B 'discard':49B 'domain':56B 'drop':61B 'escap':30B 'filter':39B 'forward':55B 'forwarding-domain':54B 'generat':36B 'host':22B 'incom':62B 'insert':45B 'mail':18B,38B,63B 'notif':31B 'redirect':47B,59B 'restrict':57B 'script':40B 'self':21B 'self-host':20B 'siev':23B,37B,46B 'sogo':24B,25B 'statement':50B 'user':43B 'valu':33B 'written':34B","search_c":"'5.12.13':66C 'address':86C 'administr':109C 'administrator-configur':108C 'allow':74C 'arbitrari':79C 'attack':93C 'authent':75C 'bypass':106C 'configur':110C 'constraint':114C 'contain':67C 'direct':81C 'discard':99C,118C 'domain':113C 'emb':95C 'forward':112C 'forwarding-domain':111C 'generat':90C 'incom':119C 'inject':71C,78C 'insert':83C 'mail':120C 'notif':85C 'notificationaddress':103C 'prefer':104C 'redirect':97C,116C 'script':70C,92C 'siev':69C,80C,91C,96C 'sogo':64C 'statement':100C 'unescap':84C 'user':76C 'valu':87C 'vulner':72C 'within':101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T16:19:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127135","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127135","severity":null,"published_at":"2026-11-12T16:19:08+00:00","modified_at":"2026-11-12T16:19:08+00:00","first_seen_at":"2026-11-12T16:44:02+00:00","fetched_at":"2026-11-12T16:44:02+00:00","note":null}],"documents":[{"id":136541,"url":"https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":136548,"url":"https://www.vulncheck.com/advisories/sogo-before-sieve-script-injection-via-notification-address","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}