CVE-2016-6190 in SOGo
Summary
by MITRE
SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the "View the Date & Time" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all users.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2025
The vulnerability identified as CVE-2016-6190 affects SOGo, a web-based groupware server that provides calendar and contact management services. This issue exists in versions prior to 2.3.12 and 3.x prior to 3.1.1, representing a significant information disclosure flaw that undermines the security of calendar appointment data. The vulnerability stems from insufficient access controls on critical calendar attributes, specifically the UID and DTSTAMP fields that are essential for tracking and managing appointments within the system.
The technical flaw manifests in the improper handling of access restrictions for calendar appointment metadata. When users have the "View the Date & Time" restriction applied to their calendar entries, the system fails to properly enforce access controls on the UID and DTSTAMP attributes. These attributes serve as unique identifiers and timestamp markers for calendar events, respectively, and their exposure allows authenticated attackers to correlate appointment data across different user accounts. The UID attribute uniquely identifies each calendar event, while the DTSTAMP attribute records when the event was created or modified, making these fields particularly sensitive for privacy and security purposes.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables sophisticated reconnaissance activities that can reveal patterns in user behavior and calendar usage across an organization. An attacker with valid credentials can leverage this flaw to map out calendar relationships and potentially identify sensitive business operations, personal appointments, or confidential meeting schedules that should remain private. This information can be used for social engineering attacks, targeted phishing campaigns, or to gain insights into organizational structures and decision-making processes. The vulnerability essentially undermines the principle of least privilege by allowing unauthorized data correlation between user accounts that should remain isolated.
From a cybersecurity perspective, this vulnerability maps to CWE-200, which describes "Information Exposure," and represents a specific instance of inadequate access control mechanisms. The flaw also aligns with ATT&CK technique T1083, "File and Directory Discovery," as it enables attackers to discover and correlate calendar data across multiple user accounts. Organizations using SOGo implementations that have not been updated to versions 2.3.12 or 3.1.1 face significant risk of unauthorized data exposure, particularly in environments where calendar data contains sensitive business information or personal details. The vulnerability demonstrates the critical importance of proper access control implementation in collaborative software systems where multiple users share common resources.
The recommended mitigations include immediate upgrading to SOGo versions 2.3.12 or 3.1.1, which contain the necessary patches to properly enforce access restrictions on UID and DTSTAMP attributes. Organizations should also implement additional monitoring for unusual calendar access patterns and consider implementing role-based access controls that further limit data exposure. Security teams should conduct comprehensive reviews of calendar access policies and ensure that all users with "View the Date & Time" restrictions are properly vetted and that their access levels are appropriate for their roles within the organization. Regular security assessments of collaborative software systems are essential to identify similar access control weaknesses that could lead to similar information disclosure vulnerabilities.