CVE-2026-74865
Authentication Bypass in sogo_yhn
YunoHost-Apps sogo_yhn
CVSS
9.2CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.38%Chance of exploitation activity in the next 30 days, higher than 30% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 5.8.0~ynh9sogo_yhnCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's account.
This issue was fixed in version 5.8.0~ynh9.
Text from CVE List
Affected versions 1
- sogo_yhnaffected: all versions before 5.8.0~ynh9CVE List