OpenTelemetry's Azure auth extension doesn't actually check your tokens

SOGo before 5.12.7 has a SQL injection bug in its password-change flow when you're using PostgreSQL or MariaDB with cleartext password storage. An attacker who can hit the password change endpoint can inject SQL through the c_password parameter. This only applies if your SOGo instance stores passwords in cleartext, which narrows the blast radius but makes it worse if you're in that camp.

Affected estate

SOGo sysadmins running versions before 5.12.7 with PostgreSQL or MariaDB backends and cleartext password storage enabled

How to check

Run 'sogo-tool --version' or check your package manager. Review your SOGo config for the password storage method and database backend.

Included because

SQL injection; authenticated but low complexity; common groupware product; CVSS 7.1

Action

Upgrade SOGo to 5.12.7 or later.

Why it matters

SQL injection in the password-change flow can let an attacker read or modify your database.

A separate SQL injection bug exists in SOGo before 5.12.7 when PostgreSQL is the backend. Unlike CVE-2026-46446, this one isn't limited to the cleartext-password scenario. If you're running SOGo with PostgreSQL, you're exposed.

Affected estate

SOGo sysadmins running versions before 5.12.7 with a PostgreSQL backend

How to check

Run 'sogo-tool --version' or check your package manager. Confirm PostgreSQL is the configured database backend.

Included because

SQL injection; common groupware product; PostgreSQL backend; CVSS 7.1

Why it matters

SQL injection with a PostgreSQL backend can expose or corrupt your mail and calendar data.

If you use IPv6 addresses in your Auth Proxy allow-list without specifying a subnet mask, the system defaults to /32 instead of /128. That means your allow-list is effectively meaningless for IPv6, since /32 covers an enormous range and lets unauthorized sources through. Only the Auth Proxy feature is affected. Okta, SAML, LDAP, and other auth methods are fine.

Affected estate

Anyone using the Auth Proxy feature with IPv6 allow-lists who hasn't explicitly specified subnet masks

How to check

Review your Auth Proxy configuration for IPv6 addresses without a /128 (or other explicit) mask.

Included because

authentication bypass potential; misconfiguration default; CVSS 7.4

Action

Append /128 to each IPv6 address in the Auth Proxy allow-list, then apply the vendor's fix.

Why it matters

The overly broad /32 default lets unauthorized IPv6 sources bypass your Auth Proxy allow-list.

The Zoom Rooms installer for Windows before version 7.0.0 searches for libraries in untrusted directories. A local attacker who can place a malicious DLL in the right path can escalate privileges when the installer runs. This requires local access and an authenticated user to trigger the install, so remote exploitation isn't a factor.

Affected estate

Windows sysadmins deploying Zoom Rooms on conference room PCs or kiosks running versions before 7.0.0

How to check

Check the installed Zoom Rooms version in Programs and Features or via your software inventory tool.

Included because

privilege escalation; requires local access; common enterprise product; CVSS 7.8

Action

Update Zoom Rooms to version 7.0.0 or later.

Why it matters

A local user could escalate to higher privileges on shared conference room or kiosk systems during install or upgrade.