CVE-2026-127145 · Package
NO FIX YET · SEE WHAT TO DO
SOGo, a groupware server, lets logged-in users add a web calendar from any URL, and the server then fetches it. An attacker with a normal account can use this to make the server connect to internal hosts and ports and learn from the responses what is running there.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run SOGo as a groupware server with user accounts, especially where internal services sit on the same network as the SOGo server. Deployments that do not run SOGo, or that restrict who can log in, have a smaller exposure; the sources do not describe other conditions.
Not affected if no-untrusted-users, sogo-not-installed
Who cares groupware, self-hosted, sogo
5.12.13 are affected.5.12.13 or later, per the NVD description (before 5.12.13 is affected).SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server's position.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.