sogo_yhn (YunoHost-Apps): Authentication bypass via forged remote-user header
Summary
The YunoHost package sogo_yhn for the SOGo groupware is affected. Its SOGo configuration trusts the HTTP header x-webobjects-remote-user without password validation, and Nginx does not strip this header. A network attacker can send this header to log in as any user, including privileged users, without a password. CVSS 4.0 rates this 9.3 (Critical). The same package also has a separate issue, CVE-2026-74865.
Affected
- YunoHost-Apps sogo_yhn: all versions before 5.8.0~ynh9
Fixed in
- Upgrade to sogo_yhn 5.8.0~ynh9 or later
Workaround
- Unknown. The sources describe no workaround; upgrading is the only documented fix.
- Interim measure (not from a source): restrict access to the SOGo web interface to a VPN or trusted networks until the upgrade is done.
Exploitation
- No known exploitation in the wild according to the sources; CISA SSVC lists exploitation as none and automatable as yes.
- No public proof of concept found in the research.
- NVD status: Deferred.
Our recommendation
- Check whether sogo_yhn is installed and whether the version is before 5.8.0~ynh9.
- Update to 5.8.0~ynh9 or later with yunohost app upgrade, and restart the server afterwards.
- Upgrade to YunoHost 12 first if the installation runs on YunoHost 11; the fixed package requires YunoHost 12.1.38 or later.
- Expect SSO login to stop working after the update, because the vendor disables SSO until the migration to SOGo 6.
- Until patched, restrict access to the SOGo interface to VPN or trusted networks.
- If the instance was internet-facing, review SOGo logs for logins from unexpected sources.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT Polska: Vulnerabilities in YunoHost-Apps sogo_yhn software cert.pl
- YunoHost Forum: SOGo critical vulnerability fixed in 5.8.0~ynh9 forum.yunohost.org
- YunoHost-Apps sogo_ynh repository github.com
- OffSeq Radar: CVE-2026-74864 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:51.
Original description (NVD)
sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user, including a privileged user, without providing a password. This issue was fixed in version 5.8.0~ynh9.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.