sogo_yhn vulnerabilities

2 known vulnerabilities in sogo_yhn from YunoHost-Apps. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.2 Critical severity

  sogo_yhn: Authorization Bypass Through User-Controlled Key

  CVE-2026-74865Sep 30, 2026YunoHost-Apps

  sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can suc

• 9.3 Critical severity

  sogo_yhn: Authorization Bypass Through User-Controlled Key

  CVE-2026-74864Sep 30, 2026YunoHost-Apps

  sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbi