CVE-2026-8496

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8496", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-05-13T17:31:27.218Z", "datePublished": "2026-05-13T18:02:54.459Z", "dateUpdated": "2026-08-06T21:56:17.903Z"}, "containers": {"cna": {"title": "A cross-site scripting (XSS) vulnerability in Alinto SOGo, version 5.12.7", "descriptions": [{"lang": "en", "value": "A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue occurs because SVG content embedded in the description field of an ICS file, with an onrepeat event handler, is insufficiently sanitized before being rendered in the webmail interface. A remote attacker can execute JavaScript in the victim's browser when the malicious calendar invite is viewed. Successful exploitation may allow mailbox access, email and contact theft, session hijacking, and other actions allowed by an authenticated user."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Alinto SOGo", "product": "SOGo", "versions": [{"status": "affected", "version": "0", "lessThan": "5.12.8", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "description": "CWE-116 Improper Encoding or Escaping of Output"}]}], "references": [{"url": "https://github.com/Alinto/sogo/commit/67ce01ec2a1a7854d8e9f615dd65afb949043e86"}, {"url": "https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.8"}, {"url": "https://www.sogo.nu/news/2026/sogo-v5128-released.html"}], "x_generator": {"engine": "VINCE 3.0.40", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-8496"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-05-13T18:02:54.459Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-13T18:55:59.267006Z", "id": "CVE-2026-8496", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T18:56:18.944Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://www.kb.cert.org/vuls/id/487613"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-06T21:56:17.903Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-8496", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T18:55:59.267006Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T18:56:14.922Z"}}], "cna": {"title": "A cross-site scripting (XSS) vulnerability in Alinto SOGo, version 5.12.7", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Alinto SOGo", "product": "SOGo", "versions": [{"status": "affected", "version": "0", "lessThan": "5.12.8", "versionType": "custom"}]}], "references": [{"url": "https://github.com/Alinto/sogo/commit/67ce01ec2a1a7854d8e9f615dd65afb949043e86"}, {"url": "https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.8"}, {"url": "https://www.sogo.nu/news/2026/sogo-v5128-released.html"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.40", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-8496"}, "descriptions": [{"lang": "en", "value": "A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue occurs because SVG content embedded in the description field of an ICS file, with an onrepeat event handler, is insufficiently sanitized before being rendered in the webmail interface. A remote attacker can execute JavaScript in the victim's browser when the malicious calendar invite is viewed. Successful exploitation may allow mailbox access, email and contact theft, session hijacking, and other actions allowed by an authenticated user."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "description": "CWE-116 Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-05-13T18:02:54.459Z"}}}, "cveMetadata": {"cveId": "CVE-2026-8496", "state": "PUBLISHED", "dateUpdated": "2026-05-13T18:56:18.944Z", "dateReserved": "2026-05-13T17:31:27.218Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-05-13T18:02:54.459Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "SOGo", "vendor": "Alinto SOGo", "versions": [{"lessThan": "5.12.8", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cret@cert.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue occurs because SVG content embedded in the description field of an ICS file, with an onrepeat event handler, is insufficiently sanitized before being rendered in the webmail interface. A remote attacker can execute JavaScript in the victim's browser when the malicious calendar invite is viewed. Successful exploitation may allow mailbox access, email and contact theft, session hijacking, and other actions allowed by an authenticated user."}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting (XSS) existe en Alinto SOGo, versi\u00f3n 5.12.7. Unos archivos de invitaci\u00f3n de calendario ICS creados maliciosamente permite la ejecuci\u00f3n arbitraria de JavaScript dentro de la sesi\u00f3n de webmail autenticada de SOGo. El problema ocurre porque el contenido SVG incrustado en el campo de descripci\u00f3n de un archivo ICS, con un gestor de eventos onrepeat, no se sanea suficientemente antes de ser renderizado en la interfaz de webmail. Un atacante remoto puede ejecutar JavaScript en el navegador de la v\u00edctima cuando se visualiza la invitaci\u00f3n de calendario maliciosa. La explotaci\u00f3n exitosa puede permitir el acceso al buz\u00f3n, el robo de correos electr\u00f3nicos y contactos, el secuestro de sesi\u00f3n y otras acciones permitidas por un usuario autenticado."}], "id": "CVE-2026-8496", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8496", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-13T18:55:59.267006Z", "version": "2.0.3"}}]}, "published": "2026-05-13T19:17:30.700", "references": [{"source": "cret@cert.org", "url": "https://github.com/Alinto/sogo/commit/67ce01ec2a1a7854d8e9f615dd65afb949043e86"}, {"source": "cret@cert.org", "url": "https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.8"}, {"source": "cret@cert.org", "url": "https://www.sogo.nu/news/2026/sogo-v5128-released.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.kb.cert.org/vuls/id/487613"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Deferred"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.12.8)"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 81.0, "source": "matching"}]}, "original": {"product": "SOGo", "source": "cna", "vendor": "Alinto SOGo"}, "product": "sogo", "vendor": "alinto"}], "created": "2026-05-13T20:30:04.260210+00:00", "updated": "2026-05-14T14:30:15.866297+00:00", "vendors": ["alinto", "alinto$PRODUCT$sogo"], "weaknesses": ["CWE-79"]}