SOGo CVE-2026-93453

Requires that SOGo's optional Password Recovery feature is enabled (the pre-fix code path is gated behind isPasswordRecoveryEnabled); the attacker sends an unauthenticated password-recovery request for a chosen victim while supplying an attacker-controlled Origin HTTP header, which SOGo trusts verbatim as the reset-link authority. Exploitation is LIMITED by required user interaction (UI:P - the victim must click the attacker-domain link delivered to their own recovery address), by the need to target a valid user/recovery address, and by version (SOGo before 5.12.11); it does not work against 5.12.11+ where the SOGoPasswordRecoveryBaseURLs allowlist rejects non-whitelisted Origins.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L = 8.7 High) is credible and well-supported by the source code evidence: the pre-fix passwordRecoveryEmailAction in UI/MainUI/SOGoRootPage.m built the reset URL from the client-controlled origin request header, and the 5.12.11 fix (commit 04a3e98) introduces a mandatory SOGoPasswordRecoveryBaseURLs allowlist that rejects any Origin not on the whitelist. This is a genuine unauthenticated pre-auth account-takeover primitive (CWE-640, weak password recovery), so integrity/confidentiality of victim accounts is the real driver - not merely 'information disclosure' as the single input Tag suggests. No EPSS score, no CISA KEV entry, and no public weaponized POC are provided, so there is no signal of active or automated exploitation; however, the VulnCheck advisory plus the public fix commit diff effectively constitute an exploitation recipe, and the flaw is trivial to trigger (a single crafted HTTP request). The one hard limiter is UI:P - the victim must actually click the attacker-domain reset link - and exploitation only applies where SOGo's optional Password Recovery feature is enabled. Net: a real, high-value priority for any SOGo deployment that has password recovery turned on, but not evidence of mass exploitation at this time.

An attacker submits a password-recovery request for a target SOGo user while setting a malicious Origin header (e.g. https://attacker.example). SOGo mints a valid reset token and emails it to the victim's recovery address inside a link whose authority is the attacker's domain; when the victim clicks it, the token is delivered to attacker infrastructure, letting the attacker complete the reset and seize the account. No public weaponized exploit is listed, but the VulnCheck advisory and the public fix commit make the mechanism straightforward to reproduce.