---
id: "CVE-2026-127145"
page: "https://infrastack.ai/live/CVE-2026-127145"
kind: "vulnerability"
aliases: ["CVE-2026-127145"]
title: "SOGo: authenticated users can probe internal network via web calendar URLs"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["groupware", "package", "self-hosted", "sogo"]
not_affected_if: ["no-untrusted-users", "sogo-not-installed"]
published_at: "2026-11-12T16:19:08+00:00"
first_seen_at: "2026-11-12T16:44:02+00:00"
updated_at: "2026-11-12T16:45:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127145", "first_seen_at": "2026-11-12T16:44:02+00:00"}]
exploit_sources: []
---

# SOGo: authenticated users can probe internal network via web calendar URLs

Link for people: https://infrastack.ai/live/CVE-2026-127145 (this .md is for agents)

SOGo, a groupware server, lets logged-in users add a web calendar from any URL, and the server then fetches it. An attacker with a normal account can use this to make the server connect to internal hosts and ports and learn from the responses what is running there.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SOGo version; releases before `5.12.13` are affected.
- Confirm whether users can add web calendars through the Calendar/addWebCalendar endpoint in your deployment.

## Fix

- SOGo: move to `5.12.13` or later, per the NVD description (before 5.12.13 is affected).

## Timeline

- 2026-11-12T16:44:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127145

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/sogo-before-ssrf-via-web-calendar-subscriptions
- [fix] Release notes: github.com https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13

## From the sources

SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server's position.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_