{"id":"CVE-2026-127145","kind":"vulnerability","aliases":["CVE-2026-127145"],"related":[],"title":"SOGo: authenticated users can probe internal network via web calendar URLs","description":"SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server's position.","summary":"SOGo, a groupware server, lets logged-in users add a web calendar from any URL, and the server then fetches it. An attacker with a normal account can use this to make the server connect to internal hosts and ports and learn from the responses what is running there.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["groupware","package","self-hosted","sogo"],"not_affected_if":["no-untrusted-users","sogo-not-installed"],"how_to_check":"- Check the installed SOGo version; releases before `5.12.13` are affected.\n- Confirm whether users can add web calendars through the Calendar/addWebCalendar endpoint in your deployment.","fix":"- SOGo: move to `5.12.13` or later, per the NVD description (before 5.12.13 is affected).","status":"open","published_at":"2026-11-12T16:19:08+00:00","first_seen_at":"2026-11-12T16:44:02+00:00","triaged_at":"2026-11-12T16:45:44+00:00","updated_at":"2026-11-12T16:45:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T16:45:44Z","model":"claude-haiku-5-5","output":{"fix":"- SOGo: move to `5.12.13` or later, per the NVD description (before 5.12.13 is affected).","reach":"network","title":"SOGo: authenticated users can probe internal network via web calendar URLs","impact":"low","summary":"SOGo, a groupware server, lets logged-in users add a web calendar from any URL, and the server then fetches it. An attacker with a normal account can use this to make the server connect to internal hosts and ports and learn from the responses what is running there.","audience":"businesses","category":"package","nicknames":[],"who_cares":["sogo","self-hosted","groupware"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated users map internal hosts and ports from the server.","analyst_note":"","how_to_check":"- Check the installed SOGo version; releases before `5.12.13` are affected.\n- Confirm whether users can add web calendars through the Calendar/addWebCalendar endpoint in your deployment.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["sogo-not-installed","no-untrusted-users"],"who_is_affected":"Teams that run SOGo as a groupware server with user accounts, especially where internal services sit on the same network as the SOGo server. Deployments that do not run SOGo, or that restrict who can log in, have a smaller exposure; the sources do not describe other conditions.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000734,"input_tokens":4652,"output_tokens":537,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-127145':14A,17A '-2026':13A,16A '5.12.13':75C 'account':51B 'add':33B 'allow':85C 'arbitrari':94C 'attack':47B,110C 'authent':2A,86C,133C 'calendar':10A,36B,119C 'calendar/addwebcalendar':108C 'connect':59B,92C,130C 'contain':76C 'content':137C 'control':104C 'cve':12A,15A 'destin':98C 'distinguish':125C 'endpoint':109C,123C 'failur':131C 'fetch':44B 'forgeri':82C 'groupwar':18B,26B 'host':22B,62B,96C 'intern':6A,61B,95C,141C 'invalid':136C 'learn':66B 'let':28B 'log':30B 'logged-in':29B 'make':56B,89C 'network':7A,142C 'normal':50B 'outcom':127C 'packag':19B 'port':64B,97C 'posit':147C 'probe':5A,139C 'prompt':134C 'reload':114C,122C 'request':81C 'respons':69B,126C 'run':72B 'self':21B 'self-host':20B 'server':27B,42B,58B,79C,91C,145C 'server-sid':78C 'side':80C 'sogo':1A,23B,24B,73C 'subscrib':117C 'suppli':100C 'timeout':132C 'trigger':112C 'url':11A,39B,105C 'use':53B 'user':3A,32B,87C,103C 'user-control':102C 'via':8A,120C 'vulner':83C 'web':9A,35B,118C","nicknames":[],"mitigations":[],"who_affected":"Teams that run SOGo as a groupware server with user accounts, especially where internal services sit on the same network as the SOGo server. Deployments that do not run SOGo, or that restrict who can log in, have a smaller exposure; the sources do not describe other conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["groupware","medium","package","selfhosted","sogo"],"campaign_type":null,"search_a":"'-127145':14A,17A '-2026':13A,16A 'authent':2A 'calendar':10A 'cve':12A,15A 'intern':6A 'network':7A 'probe':5A 'sogo':1A 'url':11A 'user':3A 'via':8A 'web':9A","search_b":"'account':51B 'add':33B 'attack':47B 'calendar':36B 'connect':59B 'fetch':44B 'groupwar':18B,26B 'host':22B,62B 'intern':61B 'learn':66B 'let':28B 'log':30B 'logged-in':29B 'make':56B 'normal':50B 'packag':19B 'port':64B 'respons':69B 'run':72B 'self':21B 'self-host':20B 'server':27B,42B,58B 'sogo':23B,24B 'url':39B 'use':53B 'user':32B 'web':35B","search_c":"'5.12.13':75C 'allow':85C 'arbitrari':94C 'attack':110C 'authent':86C,133C 'calendar':119C 'calendar/addwebcalendar':108C 'connect':92C,130C 'contain':76C 'content':137C 'control':104C 'destin':98C 'distinguish':125C 'endpoint':109C,123C 'failur':131C 'forgeri':82C 'host':96C 'intern':95C,141C 'invalid':136C 'make':89C 'network':142C 'outcom':127C 'port':97C 'posit':147C 'probe':139C 'prompt':134C 'reload':114C,122C 'request':81C 'respons':126C 'server':79C,91C,145C 'server-sid':78C 'side':80C 'sogo':73C 'subscrib':117C 'suppli':100C 'timeout':132C 'trigger':112C 'url':105C 'user':87C,103C 'user-control':102C 'via':120C 'vulner':83C 'web':118C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T16:19:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127145","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127145","severity":null,"published_at":"2026-11-12T16:19:08+00:00","modified_at":"2026-11-12T16:19:08+00:00","first_seen_at":"2026-11-12T16:44:02+00:00","fetched_at":"2026-11-12T16:44:02+00:00","note":null}],"documents":[{"id":136541,"url":"https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":136552,"url":"https://www.vulncheck.com/advisories/sogo-before-ssrf-via-web-calendar-subscriptions","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}