USN-8993-1: SOGo vulnerability

Q: What does an attacker need to exploit this issue?

An attacker needs to be able to trigger a password reset flow and supply a malicious Origin header. Successful exploitation could allow the attacker to obtain password reset tokens and take over accounts.

Q: Which users are at risk?

Users of affected SOGo deployments are at risk if password reset links are generated using the client-supplied Origin header. Accounts for which an attacker can initiate a password reset may be exposed to takeover.

Published Nov 3, 2026

Updated

It was discovered that SOGo used the client-supplied Origin header when constructing password reset links. A remote attacker could possibly use this issue to obtain password reset tokens and take over user accounts.

Affected Software

3 affected componentsFixes available

All of the following

ubuntu/sogo<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=26.04

ubuntu/sogo<5.12.4-1.2ubuntu0.1~esm2

5.12.4-1.2ubuntu0.1~esm2

Event History

Nov 3, 2026

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Advisory Published

via OSV·05:38 PM

Data Sourced

via OSV·05:38 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to be able to trigger a password reset flow and supply a malicious Origin header. Successful exploitation could allow the attacker to obtain password reset tokens and take over accounts.

Which users are at risk?

Users of affected SOGo deployments are at risk if password reset links are generated using the client-supplied Origin header. Accounts for which an attacker can initiate a password reset may be exposed to takeover.

USN-8993-1: SOGo vulnerability

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which users are at risk?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which users are at risk?