YunoHost sogo_yhn EUVD-2026-89797

Exploitation requires that the SOGo instance runs with SOGoTrustProxyAuthentication=YES - which the affected sogo_yhn (YunoHost) package sets by default in versions prior to 5.8.0~ynh9, so vulnerable-by-default installations are the norm rather than the exception. The attacker must supply the username of an existing user via HTTP Basic authentication; the password value is irrelevant. Limiting factors: the attacker needs a valid username (usually enumerable from email addresses), and only YunoHost-packaged SOGo deployments running the affected package versions are affected - upstream SOGo installs not configured with this proxy-trust setting are not.

This is a genuine high-priority authentication bypass despite the absence of exploitation telemetry. The vendor CVSS 4.0 score is 9.2 with an unauthenticated network vector (AV:N/PR:N/UI:N) and full C/I/A impact on the target account. The single limiting metric in the vendor vector is AC:H, but this appears conservative: per the description the vulnerable parameter (SOGoTrustProxyAuthentication=YES) was set by the sogo_yhn package itself, meaning affected installations are misconfigured by default rather than requiring the attacker to induce a rare condition - the only real 'complexity' is knowing a valid username, which is typically enumerable, so I assess AC:L. There is no EPSS score, no CISA KEV listing, and no public POC provided, so exploitation status is 'no public exploit identified at time of analysis'; the CVE was reported by CERT-PL, a credible national CERT, which supports the validity of the finding but does not indicate in-the-wild use. No SSVC decision data was supplied. Net: this is a real, easily-exploitable account-takeover flaw whose only mitigating factor is the low deployment footprint of the specific YunoHost package, not any technical difficulty. Note one data discrepancy: the primary reference URL points to CVE-2026-74864, a sibling identifier, not this CVE - verify the advisory mapping with CERT-PL.

An unauthenticated attacker who knows or guesses the username of any existing SOGo user (e.g. an email local-part) sends an HTTP Basic authentication request supplying that username with any arbitrary password. Because SOGoTrustProxyAuthentication=YES causes the backend to trust the proxy-supplied identity and skip password verification, the attacker is logged straight into the victim's mailbox, calendar, and contacts. No public exploit code has been identified, but the attack requires only a standard HTTP client.