Vulnerability record/PUBLISHED/Published Nov 12, 2026 16:01:07 UTC
CVE-2026-127145
SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server's position.
Base score5.3/ 10
SeverityMediumCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredLowPR
User interactionNoneUI
Vulnerable system confidentialityNoneVC
Vulnerable system integrityNoneVI
Vulnerable system availabilityNoneVA
Subsequent system confidentialityLowSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
CVSS vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityVulnCheck
Last updatedNov 12, 2026 16:01:07 UTC
PublishedNov 12, 2026 16:01:07 UTC
ReservedNov 12, 2026 15:50:19 UTC
Credits
- Richard Olszynský