CVE-2026-74865

CriticalCVSS 9.2

Published: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

sogo_yhn configures SOGo with the parameter "SOGoTrustProxyAuthentication=YES", causing the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's account. This issue was fixed in version 5.8.0~ynh9.

Risk Assessment

An attacker can access any user's account without knowing the password, leading to confidentiality and integrity breaches.

Recommendation

Update sogo_yhn to version 5.8.0~ynh9 or later to eliminate the authentication bypass.

Other vulnerabilities in sogo_yhn

CVE-2026-74864Critical
sogo_yhn configures SOGo with a parameter that forces requests with the HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user, including a privileged user, without providing a password. This issue was fixed in version 5.8.0~ynh9.

Original NVD description (English source)

sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's account. This issue was fixed in version 5.8.0~ynh9.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS