YunoHost-Apps vulnerabilities
We track 2 vulnerabilities in YunoHost-Apps products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 30, 2026.
2vulnerabilities
2critical
0high
0exploited
9.3average CVSS score
Latest YunoHost-Apps vulnerabilities
- 9.2 Critical severity
sogo_yhn: Authorization Bypass Through User-Controlled Key
sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can suc
- 9.3 Critical severity
sogo_yhn: Authorization Bypass Through User-Controlled Key
sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbi