CVE-2026-8496

A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue occurs because SVG content embedded in the description field of an ICS file, with an onrepeat event handler, is insufficiently sanitized before being rendered in the webmail interface. A remote attacker can execute JavaScript in the victim's browser when the malicious calendar invite is viewed. Successful exploitation may allow mailbox access, email and contact theft, session hijacking, and other actions allowed by an authenticated user.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/Alinto/sogo/commit/67ce01ec2a1a7854d8e9f615dd65afb949043e86
https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.8
https://www.sogo.nu/news/2026/sogo-v5128-released.html
https://www.kb.cert.org/vuls/id/487613

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-13 19:17

Updated : 2026-08-06 22:18

NVD link : CVE-2026-8496

Mitre link : CVE-2026-8496

CVE.ORG link : CVE-2026-8496

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-8496", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8496", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T18:55:59.267006Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "Alinto SOGo", "product": "SOGo", "versions": [{"status": "affected", "version": "0", "lessThan": "5.12.8", "versionType": "custom"}]}]}], "published": "2026-05-13T19:17:30.700", "references": [{"url": "https://github.com/Alinto/sogo/commit/67ce01ec2a1a7854d8e9f615dd65afb949043e86", "source": "cret@cert.org"}, {"url": "https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.8", "source": "cret@cert.org"}, {"url": "https://www.sogo.nu/news/2026/sogo-v5128-released.html", "source": "cret@cert.org"}, {"url": "https://www.kb.cert.org/vuls/id/487613", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue occurs because SVG content embedded in the description field of an ICS file, with an onrepeat event handler, is insufficiently sanitized before being rendered in the webmail interface. A remote attacker can execute JavaScript in the victim's browser when the malicious calendar invite is viewed. Successful exploitation may allow mailbox access, email and contact theft, session hijacking, and other actions allowed by an authenticated user."}], "lastModified": "2026-08-06T22:18:33.360", "sourceIdentifier": "cret@cert.org"}