Attack Chain

1. An attacker authenticates to the SOGo application.
2. The attacker crafts a malicious HTTP request to the addUserInAcls endpoint.
3. The request includes a SQL injection payload within the uid parameter.
4. The SOGo application processes the request without proper sanitization, executing the injected SQL code.
5. The injected SQL code extracts sensitive data from the database and writes it into the sogo_acl table.
6. The attacker sends a request to the /acls API endpoint.
7. The SOGo application retrieves the data from the sogo_acl table.
8. The attacker receives the extracted data, achieving out-of-band data exfiltration.

Impact

Successful exploitation of this SQL injection vulnerability (CVE-2026-8851) allows attackers to extract arbitrary data from the SOGo database. This could include sensitive user information, credentials, and other confidential data. The CVSS v3.1 base score is 8.1, reflecting the high potential for data breach and compromise of the SOGo application and its underlying database.

Recommendation

• Upgrade SOGo to a patched version beyond 5.12.7 to remediate CVE-2026-8851.
• Deploy the Sigma rule Detect SOGo addUserInAcls SQL Injection to detect potential exploitation attempts against the addUserInAcls endpoint.
• Monitor web server logs for suspicious requests to the /acls API after unusual activity on the addUserInAcls endpoint, as this is the exfiltration point.
• Implement input validation and sanitization on the uid parameter of the addUserInAcls endpoint if patching is not immediately feasible.