MEDIUMCVSS v3.1 4.3Vulnerability
CVE-2026-127145
SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server's position.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Epss score
- 0.0029
- Cvss severity
- MEDIUM
- Cvss score
- 4.3
- Retrieved at
- 2026-11-14T00:51:03+00:00
- Last source
- FIRST EPSS
- Score
- 4.3
- Cvss version
- 3.1
- Cve id
- CVE-2026-127145
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- First seen by Signal
- 2026-11-12T19:59:23+00:00
- Name
- CVE-2026-127145
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Published at
- 2026-11-12T16:19:08.620
- Last modified
- 2026-11-13T02:18:53.920
- Epss percentile
- 0.21848
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph