UBUNTU-CVE-2026-93453: High severity ubuntu/sogo vulnerability

Published Sep 18, 2026

Updated

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastructure, enabling account takeover.

Affected Software

2 affected components

ubuntu/sogo*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SOGo to a version that resolves this vulnerability.
Fixed in 5.12.11

Event History

Sep 18, 2026

CVE Published

via OSV·12:17 AM

Data Sourced

via OSV·12:17 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

SOGo deployments running a version before 5.12.11 are affected. The issue concerns password-recovery workflows that send reset links to users' configured recovery addresses.

What does an attacker need to exploit it?

An attacker does not need authentication or elevated privileges. They need to submit a password-recovery request with a malicious Origin header and rely on a victim receiving and using the resulting reset link.

Are password-reset tokens themselves exposed?

Yes. The affected reset-link construction can cause a valid token to be included in a link whose authority points to attacker-controlled infrastructure, allowing the attacker to receive the token when the victim follows the link.

What version addresses the issue?

SOGo 5.12.11 addresses the vulnerability. Systems running versions before 5.12.11 should be treated as affected.

UBUNTU-CVE-2026-93453: High severity ubuntu/sogo vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are password-reset tokens themselves exposed?

What version addresses the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are password-reset tokens themselves exposed?

What version addresses the issue?