Loading vulnerability…
Stored XSS in Alinto SOGo ICS Calendar Invitation Rendering
CVE-2026-8496 is a cross-site scripting vulnerability in Alinto SOGo affecting version 5.12.7. The flaw is triggered when SOGo processes and renders a malicious ICS calendar invitation in the webmail interface. Specifically, content placed in the ICS DESCRIPTION field can include embedded SVG markup with an event handler such as onrepeat, and that content is insufficiently sanitized before being rendered in the authenticated user's browser. Available reporting also indicates the issue is compounded by inadequate Content Security Policy enforcement. When the victim views the crafted calendar invite, attacker-supplied JavaScript executes in the security context of the SOGo webmail session.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary JavaScript execution in the victim's authenticated SOGo webmail session. This can enable session hijacking, mailbox access, theft of emails and contacts, and execution of other actions available to the compromised user account through the webmail interface.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting or filtering inbound ICS calendar invitations from untrusted or external sources, warning users not to open unexpected calendar invites in SOGo webmail, and monitoring for suspicious calendar content that attempts to embed active markup such as SVG. Additional defensive hardening should include enforcing a restrictive Content Security Policy in the webmail interface where operationally feasible, to reduce the likelihood of script execution from rendered invitation content.
Patch, then assume compromise.
Upgrade SOGo to version 5.12.8 or later, which contains the vendor patch for CVE-2026-8496. Apply any downstream distribution security updates that incorporate the fix. Validate that ICS content rendered by SOGo is properly sanitized, particularly HTML and SVG-capable fields such as DESCRIPTION, and confirm that the deployed version includes the vendor's correction.
No public exploits tracked yet. Mallory keeps watching.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.