LoginSign Up
← Back to all sparks
S

SOGo

COLLAB
Velocity5.0

Groupware server with shared calendars, address books and webmail

www.sogo.nu ↗

SOGo's 5.12.13 fixes its largest batch of vulnerabilities yet, some critical.

groupwareself-hostedsecuritywebmailsecure-defaults
◆Current state
SOGo, Alinto's self-hosted webmail, calendar and contacts suite, has made almost every 2026 release about security. v5.12.13 on 4 November fixes two SQL injections, a buffer overflow, an LDAP filter injection, path traversal, an impersonation flaw and several unsafe HTML elements, affecting all previous versions. It follows 5.12.11's password reset poisoning fix and 5.12.12's switch to verifying LDAP TLS certificates by default.
◆Where it's heading
Outside researchers and coordinators such as VulnCheck are now reporting issues in batches, and each release closes several at once. The fixes are moving from individual XSS paths toward input handling across SQL, LDAP and file paths, which points to a broader audit of the codebase rather than one-off patches.
◆Prediction
Expect CVE IDs for the 5.12.13 fixes to be published and further 5.12.x security releases at a roughly monthly pace; the entries show no sign of a feature release.

◆Recent moves

  1. 10d ago

    SOGo 5.12.13 fixes SQL injections, overflow and impersonation

    The biggest security release in a year of security releases: two SQL injections, a buffer overflow, LDAP filter injection, path traversal and impersonation, some rated critical and affecting every prior version. Admins on any earlier build should update now.

    View source ↗
  2. 1mo ago

    SOGo 5.12.12 fixes a vulnerability, enforces LDAP TLS checks

    Fixes one major security vulnerability and now verifies LDAP TLS certificates by default, so self-signed LDAPS setups must opt out in sogo.conf.

    View source ↗
  3. 2mo ago

    SOGo 5.12.11: reset poisoning and XSS fixed, new required setting

    Fixes password reset poisoning and several XSS injections affecting all previous versions, and makes SOGoPasswordRecoveryBaseURLs mandatory when password recovery is enabled, with an error if it is unset. Admins need to set it before upgrading, and the XSS fix may change how some mail displays.

    View source ↗
  4. 3mo ago

    Four more vulnerabilities patched; all prior versions affected

    Another batch security release: a possible SQL injection on a specific request and several possible XSS injections, present since at least the May 12 nightly and affecting every previous version. CVE identifiers had not been issued at publication. The fourth such batch in five months, and the notes again urge immediate upgrade.

    View source ↗
  5. 5mo ago

    Patch undoes 5.12.8 regressions in preferences and mail display

    Repairs four regressions introduced by the previous security release — preferences that would not save, event invitations rendering wrongly, and mail displayed incorrectly in search results. The recurring shape here: a fast security batch, then a patch cleaning up what it broke.

    View source ↗
  6. 6mo ago

    Two CVEs fixed for PostgreSQL user sources

    Two major vulnerabilities fixed, this time scoped to a specific configuration rather than every deployment. Published after 5.12.8 despite the lower version number — a reminder that this feed's ordering does not follow its versioning.

    View source ↗