Skip to content
OpenAdvisories
High USN-8993-1 1 CVE

sogo vulnerability

Published Nov 3, 2026 · Updated Nov 4, 2026

Ecosystem: Ubuntu

Summary

It was discovered that SOGo used the client-supplied Origin header when
constructing password reset links. A remote attacker could possibly use
this issue to obtain password reset tokens and take over user accounts.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 26.04 LTS Pro:26.04:LTS sogo 5.12.4-1.2ubuntu0.1~esm2

Vulnerabilities 1

  • High 8.3
    CVE-2026-93453 Public exploit

    SOGo before 5.12.11 Password Reset Token Interception via Origin Header

    SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a…

    Alinto SOGo sogo sogo Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2026-93453