UBUNTU-CVE-2026-127111: Critical severity ubuntu/sogo vulnerability
SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint without lockout or rate limiting. Attackers can submit unlimited candidate answers to obtain a valid recovery JWT, then use it to change the account password without the old credential and log in via the connect endpoint, achieving full account takeover on accounts without TOTP enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SOGoto a version that resolves this vulnerability.Fixed in 5.12.13
Event History
Frequently Asked Questions
Which accounts are susceptible to takeover?
Accounts that use secret-question password recovery and do not have TOTP enabled are susceptible. An attacker who successfully guesses the recovery answer can obtain a recovery JWT, reset the password, and authenticate as that user.
Does exploitation require an existing account or user interaction?
No. The issue is exploitable by an unauthenticated remote attacker and does not require user interaction, but the attacker must repeatedly guess a target account's secret-question answer.
What makes password-recovery endpoints particularly exposed?
The passwordRecoveryCheck endpoint permits unlimited candidate secret-question answers without lockout or rate limiting. This enables repeated guessing until a valid recovery JWT is obtained.
What version addresses this issue?
SOGo 5.12.13 is identified as the release boundary; versions before 5.12.13 are affected.