Vulnerability · Published Aug 4, 2025 · Assigned by mitre
CVE-2025-50340
Medium 4.3
In plain English
A medium-severity authorization bypass via user-controlled key in the sogo package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
An Insecure Direct Object Reference (IDOR) vulnerability was discovered in SOGo Webmail thru 5.6.0, allowing an authenticated user to send emails on behalf of other users by manipulating a user-controlled identifier in the email-sending request. The server fails to verify whether the authenticated user is authorized to use the specified sender identity, resulting in unauthorized message delivery as another user. This can lead to impersonation, phishing, or unauthorized communication within the system. NOTE: this is disputed by the Supplier because the only effective way to prevent this sender spoofing is on the SMTP server, not within a client such as SOGo.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | sogo | no fix listed | CVE-2025-50340 |
| Debian:13 | sogo | no fix listed | CVE-2025-50340 |
| Debian:14 | sogo | no fix listed | CVE-2025-50340 |
| Ubuntu:25.10 | sogo | no fix listed | UBUNTU-CVE-2025-50340 |
| Ubuntu:26.10 | sogo | no fix listed | UBUNTU-CVE-2025-50340 |
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N