The Alinto team is pleased to announce the immediate availability of SOGo v5.12.11. This is a major release as it fixes security vulnerabilities.

IMPORTANT

Three major vulnerabilities have been reported and fixed in this version 5.12.11 or since the nightly of the 13th of September 2026: sogo_5.12.9.20260810.

Those vulnerabilities affect any previous SOGO version. Please update as soon as possible

CVE ID will be updated once they’re created

• 1 Password reset poisoning -> fixed
• Several XSS injections with malicious mail or request -> fixed

New mandatory setting for password reset

If the password recovery is enabled SOGoPasswordRecoveryEnabled = YES;, you must set base URLs that are allowed to be used:

SOGoPasswordRecoveryBaseURLs = ("https://demo.sogo.nu");

or if several frontend use the same backend:

SOGoPasswordRecoveryBaseURLs = ("https://platform1.sogo.nu", "https://platform2.sogo.nu);

Do not end the URLs by ‘/’

No defaults, will throw an error if empty or unset

Thanks

Thanks to the reporter of vulnerabilities:

• Faceless0x7 for the Password reset poisoning.
• Jan from Turingpoint for the reporting the XSS injections AND fixing them.
• One person (they didn’t answer if we can quote them or not) for another XSS injection.
• Sébastien MIZRAHI for reviewing and improving some of the fix.

Regression

Display

Due to the XSS injection fix, webmail display may be affected. If that’s the case, please report a bug https://bugs.sogo.nu

Others thing

Features

• junk: add junk action on mail view (3f4f949). You can also choose the junk icon among a predefined list. Look for setting mailJunkIcon in the documentation.

Bug Fixes

• core: keep the @import cleanup working in stringWithoutHTMLInjection (8813677)
• db: release db channel after using them (152f44b)
• db: release db channel after using them part 2 (089b50c)
• junk: extend list of junk icon available (012e6ef)
• mail: escape mail data placed in attributes of a compiled part (045a0b9), closes #115
• mail: stop interpreting iMIP card text fields as markup (0d66d75)
• pwd: use the proper url for reset password mail (382118a)
• pwd: use the proper url for reset password mail part2 (04a3e98)
• sanitization: update regex for html sanitization (10dc173)
• UI: use legitimate sorting value (d089c40)

Localization

• hu: Update Hungarian translations (1bf1031)

See the complete change log.