---
id: "CVE-2026-127135"
page: "https://infrastack.ai/live/CVE-2026-127135"
kind: "vulnerability"
aliases: ["CVE-2026-127135"]
title: "SOGo: Sieve script injection lets users redirect or discard incoming mail"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["mail", "other", "self-hosted", "sieve", "sogo"]
not_affected_if: ["no-user-notification-settings", "sieve-disabled"]
published_at: "2026-11-12T16:19:08+00:00"
first_seen_at: "2026-11-12T16:44:02+00:00"
updated_at: "2026-11-12T16:45:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127135", "first_seen_at": "2026-11-12T16:44:02+00:00"}]
exploit_sources: []
---

# SOGo: Sieve script injection lets users redirect or discard incoming mail

Link for people: https://infrastack.ai/live/CVE-2026-127135 (this .md is for agents)

SOGo before 5.12.13 does not escape notification address values written into generated Sieve mail filter scripts. An authenticated user can insert Sieve redirect or discard statements that bypass the forwarding-domain restriction and redirect or drop incoming mail.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SOGo version against the fixed release in the product ranges (unknown if not given)
- Review whether the notificationAddress preference is enabled for users and whether the administrator sets a forwarding-domain constraint

## Fix

- SOGo: move to `5.12.13` or later

## Timeline

- 2026-11-12T16:44:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127135

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/sogo-before-sieve-script-injection-via-notification-address
- [fix] Release notes: github.com https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13

## From the sources

SOGo before 5.12.13 contains a Sieve script injection vulnerability that allows authenticated users to inject arbitrary Sieve directives by inserting unescaped notification address values into a generated Sieve script. Attackers can embed Sieve redirect or discard statements within the notificationAddress preference to bypass the administrator-configured forwarding-domain constraint and redirect or discard incoming mail.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_