SOGo: Webmail Session Takeover Through a Calendar Invitation

An attacker without an account sends a calendar invitation by mail whose description text is executed as an AngularJS expression when the message is opened.

Advisory ID: TP-2026-081
Product: SOGo (groupware with webmail, calendar and address book)
Vulnerability type: Client-side template injection (CWE-1336)
CVE: requested (MITRE CNA-LR), assignment pending
CVSS 3.1: 9.6 (Critical) · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected versions: <= 5.12.9
Vendor advisory: SOGo 5.12.10 release notes
Fixed in: 5.12.10
Reported: 15 June 2026

Summary

SOGo is a groupware suite whose webmail renders an incoming meeting invitation as a card inside the mailbox. That card is compiled by AngularJS in the browser, and the description text of the invitation reaches it unescaped. An AngularJS expression in curly braces is therefore not displayed but evaluated, and because AngularJS 1.8.3 no longer carries an expression sandbox, it executes arbitrary JavaScript. The attacker needs no account on the server, they send the victim an ordinary calendar invitation by mail. When the victim opens the message, foreign code runs inside their authenticated webmail session.

Root cause

The card of an incoming invitation is rendered through $compile on the client because the sg-imip directive requires a compiled template (UI/Templates/MailerUI/UIxMailViewTemplate.wox:428-433). The server writes the event description into that very card without escaping it (UI/Templates/MailPartViewers/UIxMailPartICalViewer.wox:243 and :304, both carrying const:escapeHTML="NO"). The method used there, stringByDetectingURLs, only turns text into links and does not escape <, > or & (SoObjects/SOGo/NSString+Utilities.m:206). AngularJS 1.8.3 has carried no expression sandbox since version 1.6, so $compile evaluates the content of curly braces, and HTML escaping would not have changed that because curly braces are not special in HTML. SOGo ships no Content Security Policy in its default configuration, so nothing contains the execution.

Proof of Concept

Content-Type: text/calendar; method=REQUEST

BEGIN:VCALENDAR
BEGIN:VEVENT
SUMMARY:Project update
DESCRIPTION:{{1337*1337}}
END:VEVENT
END:VCALENDAR

-> the opened invitation shows 1787569 instead of the expression

The computed number proves that the field content is evaluated as an AngularJS expression rather than printed as text. In the same place, an expression using the function constructor instead of a multiplication yields arbitrary JavaScript, which runs as soon as the message is opened and without further interaction.

Impact

  • Reading, sending and deleting messages inside the victim's authenticated session.
  • Reading the XSRF token, which is not marked HttpOnly, through document.cookie, which defeats the existing CSRF protection.
  • Self propagation, because the executed code sends the same invitation from the victim's mailbox to their contacts.
  • Access to every mailbox on the instance if the victim is listed in SOGoSuperUsernames.

References

Is Something Like This in Your Software?

Our team found this vulnerability in the course of its work. Have your applications tested by the same specialists, with a penetration test from turingpoint.

Request a Pentest