Vulnerability · Published Sep 30, 2026 · Assigned by CERT-PL

CVE-2026-74864Authentication Bypass in sogo_yhn

Critical 9.3

In plain English

A critical-severity authorization bypass via user-controlled key in sogo_yhn from YunoHost-Apps. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.4%top 64.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user, including a privileged user, without providing a password. This issue was fixed in version 5.8.0~ynh9.

Affected products (as reported)

Vendor	Product	Versions
YunoHost-Apps	sogo_yhn	0 – before 5.8.0~ynh9

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://cert.pl/en/posts/2026/09/CVE-2026-74864 third-party-advisory
https://forum.yunohost.org/t/sogo-critical-vulnerability-fixed-in-5-8-0-ynh9/42699 issue-tracking