The Alinto team is pleased to announce the immediate availability of SOGo v5.12.12. This is a major release as it fixes one security vulnerability.

IMPORTANT LDAP WITH SSL

If you're using ldap with ssl with a self-signed certificate, you have to update your sogo.conf to tell sogo to not check it:

Before:
hostname = ldaps://10.0.2.15:636;

After:
hostname = ldaps://10.0.2.15:636?tlsVerifyMode=None;

If not, sogo will force ldap client to check the certificate and throw error like this:

NAME:LDAPException REASON:operation bind failed: Can't contact LDAP server (0xFFFFFFFF)

IMPORTANT

One major vulnerability have been reported and fixed in this version 5.12.12 or since the nightly of the 13th of October 2026: sogo_5.12.9.20261013.

This vulnerability affects any previous version of SOGo. Please update as soon as possible

CVE ID will be updated once they're created

• one IDOR (Insecure Direct Object Reference) -> fixed

Fix the regression of 5.12.11

The mail sorting, except by date, was not working anymore since 5.12.11 and has been fixed in this version.

Thanks

Thanks to:

• kta1kri for the report of the vulnerability!
• To our contributors for this release: tachtler, Hadrien Blanc and WoodySlum.

Others thing

• contact: set proper protection search endpoint (dbf27ba)
• doc: typos (aa7f82c)
• mail: fix the sort value (6c93d6b)
• mail: Keep content of Outlook downlevel-revealed conditional comments. Fixes #6167. (be3630d)
• mail: sanitize the domain part of generated message-ids (20779cf), closes #6201
• pwd: fix 0 value for password policy (981df7b)
• ldap(SOPE): do not verify certificate if tlsVerifyMode=None (ffddcc)
• core(SOPE): use a 64-bit content length in HTTP responses (72baa1)