CVE-2026-46446
HIGH
NVD
CVSS Score
7.1
Severity
HIGH
Published
May 14, 2026
Vendor
unknown
Description
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.