Skip to main content

VU#487613: Alinto SOGo v5.12.7 vulnerable to cross-site scripting via malformed ICS calendar invitations

Source Decision Insights Threat Desk Published August 23, 2026
Human View Machine View

Best suited for

Seniority
C Level / Executive Team
Job function
Chief Information Security Officer
Persona
Security Operations Leader
Buyer role
Decision Maker / Budget Holder
Decision stage
Post Buy
Adoption curve
Early Majority
Technology maturity
Established Technology
Industry
Information Technology / Software & Services / IT Services / Cloud Services

Our classification, not the publisher's statement. Best suited for, not only for.

Alinto SOGo versions prior to 5.12.8 have a cross-site scripting vulnerability in how the product processes ICS (iCalendar) invitations, enabling remote code execution through embedded malicious SVG content. The highest-level impact described is that a victim who views the calendar can have an XSS payload executed in the SOGo webmail interface.

The issue is identified as CVE-2026-8496. The vulnerability is in SOGo handling of ICS files, specifically rendering the DESCRIPTION field without proper sanitization or Content Security Policy (CSP) enforcement. When a calendar invite contains an SVG payload with JavaScript event handlers, the browser executes the script in the context of the SOGo webmail interface. This execution occurs during normal calendar view rendering, such as when a user opens or previews the calendar tab, and it can happen without explicit interaction.

The advisory describes that once an attacker delivers a malicious ICS file via email, any user who views the calendar will execute the embedded XSS payload, granting full read access to the victim's mailbox. The document lists credential theft through forced logout/login phishing, password manager autofill hijacking, full exfiltration of email messages, folder contents, and metadata, and extraction of contact lists and calendar data.

Users are recommended to upgrade to SOGo v5.12.8 or newer. The advisory states that v5.12.8 addresses the issue by sanitizing ICS DESCRIPTION content and by applying stricter handling of embedded SVG and HTML.

The guidance section of the advisory directs users to upgrade to SOGo v5.12.8 or newer. It also includes acknowledgements thanking Greg Lesnewich for reporting the issue and noting that the vulnerability note was prepared by Alexander Curtis.

Blog post, originally published at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/vu487613:-alinto-sogo-v5.12.7-vulnerable-to-cross-site-scripting-via-malformed-ics-calendar-invitations/",
        "name": "VU#487613: Alinto SOGo v5.12.7 vulnerable to cross-site scripting via malformed ICS calendar invitations",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/vu487613:-alinto-sogo-v5.12.7-vulnerable-to-cross-site-scripting-via-malformed-ics-calendar-invitations/#blogposting",
    "@type": "BlogPosting",
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "C Level / Executive Team"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Chief Information Security Officer"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Decision Maker / Budget Holder"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Technology maturity",
        "audienceType": "Established Technology"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Cloud Services"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T12:12:47-06:00",
    "datePublished": "2026-08-23T05:51:54-06:00",
    "description": "Alinto SOGo versions prior to 5.12.8 have an XSS vulnerability in ICS DESCRIPTION rendering that can execute an SVG payload in the webmail interface, CVE-2026-8496.",
    "headline": "VU#487613: Alinto SOGo v5.12.7 vulnerable to cross-site scripting via malformed ICS calendar invitations",
    "isBasedOn": {
      "@type": "CreativeWork",
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/487613"
    },
    "keywords": [
      "Cross-Site Scripting",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/vu487613:-alinto-sogo-v5.12.7-vulnerable-to-cross-site-scripting-via-malformed-ics-calendar-invitations/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages