Critical severityNVD Advisory· Published Sep 30, 2026

CVE-2026-74865

Description

sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's account.

This issue was fixed in version 5.8.0~ynh9.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

SOGo/SOGollm-fuzzy
Range: <5.8.0~ynh9

Patches

Vulnerability mechanics

References

cert.pl/en/posts/2026/09/CVE-2026-74864nvd
forum.yunohost.org/t/sogo-critical-vulnerability-fixed-in-5-8-0-ynh9/42699nvd

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000