CVE-2026-93453
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastructure, enabling account takeover.
Risk Assessment
The risk includes account takeover through theft of password reset tokens. The attack does not require authentication, increasing its accessibility to a wide range of attackers.
Recommendation
Upgrade SOGo to version 5.12.11 or later, which no longer uses the Origin header for constructing password reset links.
Other vulnerabilities in SOGo
See all- CVE-2026-46446High
SOGo before 5.12.7, when using PostgreSQL or MariaDB and storing cleartext passwords, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.
- CVE-2026-46445High
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
- CVE-2015-5395High
CVE-2015-5395 is a cross-site request forgery (CSRF) vulnerability in SOGo before version 3.1.0. An attacker can exploit this vulnerability to perform unauthorized actions on behalf of the user.
- CVE-2026-39179Medium
A SQL injection vulnerability in SOGo before version 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality.
- CVE-2026-39178Medium
A SQL injection vulnerability in SOGo before version 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint.
- CVE-2026-8851High
SOGo versions up to 5.12.7 contain a SQL injection vulnerability in the Access Control List management functionality. An authenticated user can inject malicious SQL subqueries through the uid parameter of the addUserInAcls endpoint, allowing extraction of arbitrary data from the database. Attackers can write extracted data into the sogo_acl table and retrieve it via the /acls API, establishing an out-of-band data exfiltration channel.
Original NVD description (English source)
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastructure, enabling account takeover.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS