Sogo Yhn
Monthly
Authentication bypass in the YunoHost-packaged SOGo application (sogo_yhn) allows unauthenticated remote attackers to log in to any existing user account by supplying only that user's username together with an arbitrary password, rated CVSS 9.2. The root cause is the package's default configuration of SOGoTrustProxyAuthentication=YES, which causes SOGo to skip password verification during HTTP Basic authentication; every package version prior to 5.8.0~ynh9 is vulnerable by default, so exposed instances are broadly at risk. No public exploit code or exploitation telemetry has been identified at time of analysis, but the bypass requires no specialized tooling beyond knowing a valid username (typically derivable from email addresses), and the vendor has released a fixed version.
Authentication bypass in the YunoHost sogo_yhn package lets any remote client impersonate an arbitrary SOGo user - including a privileged administrator - by simply sending an HTTP header, with no password required. The package configures SOGo to treat the 'x-webobjects-remote-user' header as a verified identity, and the bundled Nginx reverse proxy does not strip that inbound header, so it reaches the backend untouched; both the vendor CVSS 4.0 score (9.3) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirm unauthenticated, network-reachable, high-impact compromise without user interaction. The flaw is fixed in version 5.8.0~ynh9; no CISA KEV listing is associated with this CVE and no public exploit code was identified at time of analysis, but the trivial attack primitive (single header) and the exposed default configuration make prompt patching or proxy-level header stripping essential.
Authentication bypass in the YunoHost-packaged SOGo application (sogo_yhn) allows unauthenticated remote attackers to log in to any existing user account by supplying only that user's username together with an arbitrary password, rated CVSS 9.2. The root cause is the package's default configuration of SOGoTrustProxyAuthentication=YES, which causes SOGo to skip password verification during HTTP Basic authentication; every package version prior to 5.8.0~ynh9 is vulnerable by default, so exposed instances are broadly at risk. No public exploit code or exploitation telemetry has been identified at time of analysis, but the bypass requires no specialized tooling beyond knowing a valid username (typically derivable from email addresses), and the vendor has released a fixed version.
Authentication bypass in the YunoHost sogo_yhn package lets any remote client impersonate an arbitrary SOGo user - including a privileged administrator - by simply sending an HTTP header, with no password required. The package configures SOGo to treat the 'x-webobjects-remote-user' header as a verified identity, and the bundled Nginx reverse proxy does not strip that inbound header, so it reaches the backend untouched; both the vendor CVSS 4.0 score (9.3) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirm unauthenticated, network-reachable, high-impact compromise without user interaction. The flaw is fixed in version 5.8.0~ynh9; no CISA KEV listing is associated with this CVE and no public exploit code was identified at time of analysis, but the trivial attack primitive (single header) and the exposed default configuration make prompt patching or proxy-level header stripping essential.