[ CVE-2026-74865 · Published 30 Sep 2026 ]
Vulnerability in YunoHost-Apps sogo_yhn
CVSS 9.2
EPSS <1%No fix listed yet
[ Why it matters ]Priority signals
- Critical severity: CVSS 9.2
[ Description ]Official description
sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's account. This issue was fixed in version 5.8.0~ynh9.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.