CVE-2026-8496

{
  "id": "CVE-2026-8496",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-13T19:17:30.700",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version  5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue occurs because SVG content embedded in the description field of an ICS file, with an onrepeat event handler, is insufficiently sanitized before being rendered in the webmail interface. A remote attacker can execute JavaScript in the victim's browser when the malicious calendar invite is viewed.  Successful exploitation may allow mailbox access, email and contact theft, session hijacking, and other actions allowed by an authenticated user."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de cross-site scripting (XSS) existe en Alinto SOGo, versión 5.12.7. Unos archivos de invitación de calendario ICS creados maliciosamente permite la ejecución arbitraria de JavaScript dentro de la sesión de webmail autenticada de SOGo. El problema ocurre porque el contenido SVG incrustado en el campo de descripción de un archivo ICS, con un gestor de eventos onrepeat, no se sanea suficientemente antes de ser renderizado en la interfaz de webmail. Un atacante remoto puede ejecutar JavaScript en el navegador de la víctima cuando se visualiza la invitación de calendario maliciosa. La explotación exitosa puede permitir el acceso al buzón, el robo de correos electrónicos y contactos, el secuestro de sesión y otras acciones permitidas por un usuario autenticado."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Alinto SOGo",
          "product": "SOGo",
          "versions": [
            {
              "version": "0",
              "lessThan": "5.12.8",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T18:55:59.267006Z",
          "id": "CVE-2026-8496",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "references": [
    {
      "url": "https://github.com/Alinto/sogo/commit/67ce01ec2a1a7854d8e9f615dd65afb949043e86",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.8",
      "source": "[email protected]"
    },
    {
      "url": "https://www.sogo.nu/news/2026/sogo-v5128-released.html",
      "source": "[email protected]"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/487613",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}