The Alinto team is pleased to announce the immediate availability of SOGo v5.12.12. This is a major release as it fixes one security vulnerability.

IMPORTANT

One major vulnerability have been reported and fixed in this version 5.12.12 or since the nightly of the 13th of October 2026: sogo_5.12.9.20261013.

This vulnerability affects any previous version of SOGo. Please update as soon as possible

CVE ID will be updated once they’re created

• one IDOR (Insecure Direct Object Reference) -> fixed

Fix the regression of 5.12.11

The mail sorting, except by date, was not working anymore since 5.12.11 and has been fixed in this version.

Thanks

Thanks to:

• kta1kri for the report of the vulnerability!
• To our contributors for this release: tachtler, Hadrien Blanc and WoodySlum.

Others thing

• contact: set proper protection search endpoint (dbf27ba)
• doc: typos (aa7f82c)
• mail: fix the sort value (6c93d6b)
• mail: Keep content of Outlook downlevel-revealed conditional comments. Fixes #6167. (be3630d)
• mail: sanitize the domain part of generated message-ids (20779cf), closes #6201
• pwd: fix 0 value for password policy (981df7b)
• ldap(SOPE): do not verify certificate if tlsVerifyMode=None (ffddcc)
• core(SOPE): use a 64-bit content length in HTTP responses (72baa1)

See the complete change log.