CVE-2026-127135
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Nov 12, 2026
Vendor
unknown
Description
SOGo before 5.12.13 contains a Sieve script injection vulnerability that allows authenticated users to inject arbitrary Sieve directives by inserting unescaped notification address values into a generated Sieve script. Attackers can embed Sieve redirect or discard statements within the notificationAddress preference to bypass the administrator-configured forwarding-domain constraint and redirect or discard incoming mail.