CVE-2026-127111 — SOGO
HIGHCVE-2026-127111 is a high-severity (CVSS 7.4) CWE-307 vulnerability in Alinto sogo. A fix is available — see the affected versions and patch details below.
SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly…
Description
SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint without lockout or rate limiting. Attackers can submit unlimited candidate answers to obtain a valid recovery JWT, then use it to change the account password without the old credential and log in via the connect endpoint, achieving full account takeover on accounts without TOTP enabled.
Affected Products
sogoAlintoDetection & mitigation playbook
Vendor / applianceDetect
Inventory every Alinto sogo deployment and check each version against the affected-products list above.
Fix
Apply the Alinto sogo security patch or hotfix for CVE-2026-127111 on the affected version, following the vendor advisory for your exact build.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2026-127111 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.