EUVD-2026-89796
GHSA-fxx9-8vhm-fwhc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SOGo login endpoint over network
-
DeliveryAdd forged x-webobjects-remote-user header
-
ExploitNginx forwards header unstripped
-
ExecutionSOGo trusts header as verified user
-
ImpactAccess privileged account data without password
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitable only when SOGo is deployed via the sogo_yhn YunoHost package configured with the parameter that makes it trust the 'x-webobjects-remote-user' HTTP header as a pre-authenticated identity, fronted by an Nginx reverse proxy that does not strip that inbound header - which is the default vulnerable state described. Under that configuration there is no authentication, no user interaction, and no special privilege required: any client can set the header and impersonate any account. The limiting factor is deployment footprint (this specific YunoHost app package and configuration), not attacker prerequisites; instances patched to 5.8.0~ynh9 or configured to strip/override the header at the proxy are not affected. |
| Impact | This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) describes a complete authentication bypass reachable over the network with no privileges, no user interaction, and low complexity - the strongest possible exploitability profile. The description confirms the mechanism precisely: SOGo is configured to trust the 'x-webobjects-remote-user' HTTP header as proof of a verified identity, and because the fronting Nginx does not strip that client-supplied header, any unauthenticated attacker can impersonate any account, including privileged ones. EPSS is not provided, the CVE is not in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The tempering factor is prevalence rather than difficulty: sogo_yhn is the YunoHost packaging of SOGo, a niche self-hosted deployment path, so widespread mass exploitation is unlikely even though a working request is trivial to craft. No key signals conflict; the vector, CWE, and description are mutually consistent. |
| Exploit ScenarioDerived | An attacker sends an ordinary HTTPS request to a YunoHost-hosted SOGo instance and adds the header 'x-webobjects-remote-user: admin' (or any target username). Because Nginx passes the header through and SOGo is configured to treat it as an already-verified user, the attacker is logged in as that user with no password, gaining full access to that account's mailbox, calendar, and contacts. No public PoC is referenced, but the technique is trivially reproducible with any HTTP client such as curl. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Authentication bypass in the YunoHost sogo_yhn package lets any remote client impersonate an arbitrary SOGo user - including a privileged administrator - by simply sending an HTTP header, with no password required. The package configures SOGo to treat the 'x-webobjects-remote-user' header as a verified identity, and the bundled Nginx reverse proxy does not strip that inbound header, so it reaches the backend untouched; both the vendor CVSS 4.0 score (9.3) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirm unauthenticated, network-reachable, high-impact compromise without user interaction. The flaw is fixed in version 5.8.0~ynh9; no CISA KEV listing is associated with this CVE and no public exploit code was identified at time of analysis, but the trivial attack primitive (single header) and the exposed default configuration make prompt patching or proxy-level header stripping essential.
RemediationAI
Vendor-released patch: 5.8.0~ynh9 - upgrade the sogo_yhn YunoHost package to this version (for example via the YunoHost admin interface or 'yunohost app upgrade sogo_yhn') as the primary and recommended fix; see the YunoHost advisory at https://forum.yunohost.org/t/sogo-critical-vulnerability-fixed-in-5-8-0-ynh9/42699 and CERT-PL's write-up at https://cert.pl/en/posts/2026/09/CVE-2026-74864. If patching must be deferred, apply compensating controls in order of effectiveness: (1) in the Nginx configuration fronting SOGo, unconditionally overwrite or delete the inbound header (e.g. 'proxy_set_header x-webobjects-remote-user "";' or an equivalent 'proxy_set_header' that sets it from a trusted upstream value only) and reload Nginx - this neutralizes the bypass but must be applied on every vhost/server block that reaches SOGo, and any typo or omitted location block leaves the hole open; (2) disable SOGo's proxy-authentication trust parameter so SOGo authenticates users itself - effective, but it breaks genuine SSO/proxy-authentication flows and forces users to log in with SOGo credentials directly; (3) as a stopgap, restrict network access to the SOGo web endpoint (firewall/allow-list to trusted networks or place it behind a VPN) - this reduces exposure but degrades usability for legitimate remote users and does not fix the underlying trust flaw. There is no indication that patched and unpatched instances can be distinguished by attackers short of probing, so assume exposure until the header is stripped or the package is upgraded.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): SOGo supports a proxy-authentication trust mode in which the backend accepts an externally supplied header - here 'x-webobjects-remote-user' - as the authenticated username and skips its own password validation entirely. This design originated in WebObjects-style deployments where a trusted front-end authenticator (proxy, SSO gateway, or reverse proxy) is responsible for authenticating the user and asserting the identity downstream; the security of the whole chain therefore depends on that front-end always overwriting or removing any client-supplied copy of the header. In the sogo_yhn YunoHost application package, the trust parameter was enabled while the Nginx reverse proxy did not strip the inbound 'x-webobjects-remote-user' header, so the attacker-controlled value is passed straight through to SOGo and consumed as a pre-authenticated identity. The affected CPE is cpe:2.3:a:yunohost-apps:sogo_yhn:*:*:*:*:*:*:*:* (all versions prior to the fix), and exploitation requires only a crafted HTTP request setting the header to a target account name - no credentials, no session, no user interaction, and no special network position beyond reachability of the SOGo endpoint.
Know when Yunohost gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network attacker sets a forwarded header to impersonate any user including admins, yielding full read/write control of accounts; complexity is low and no scope change to a separate system.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user, including a privileged user, without providing a password.
This issue was fixed in version 5.8.0~ynh9.
Articles & Coverage 1
Executive ViewAI
An unauthenticated attacker can take over any account on YunoHost's SOGo webmail and groupware package - including administrator accounts - simply by sending a single crafted HTTP header, exposing organizational email, calendars, contacts and platform administrative control. These deployments are typically self-hosted and internet-facing, and the package's default configuration is vulnerable, so any organization running sogo_yhn should assume its collaboration platform is reachable by outsiders. Because impersonating an administrator also opens the door to the underlying server and other connected identities, the exposure extends well beyond the mail service itself.
Apply vendor patch (5.8.0~ynh9). Where an immediate upgrade is not possible, manually strip the inbound 'x-webobjects-remote-user' header at the Nginx reverse proxy and restrict SOGo and YunoHost administrative interfaces to VPN or allowlisted source networks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The YunoHost 2.7.2 through 2.7.14 web application is affected by one HTTP Response Header Injection. Rated high severity
Two XSS vulnerabilities are located in the profile edition page of the user panel of the YunoHost 2.7.2 through 2.7.14 w
Authentication bypass in the YunoHost-packaged SOGo application (sogo_yhn) allows unauthenticated remote attackers to lo
Exploit-DB