CVE-2026-74865: Authentication Bypass in sogo_yhn

Severity: critical (CVSS 9.2 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-30 · updated 2026-09-30
Weakness: CWE-639

Description

sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's account. This issue was fixed in version 5.8.0~ynh9.

Affected products

YunoHost-Apps sogo_yhn: before 5.8.0~ynh9 — fixed in 5.8.0~ynh9

How to fix

Upgrade to a fixed version: YunoHost-Apps sogo_yhn 5.8.0~ynh9. Check the vendor advisory for mitigations.

References

https://cert.pl/en/posts/2026/09/CVE-2026-74864
https://forum.yunohost.org/t/sogo-critical-vulnerability-fixed-in-5-8-0-ynh9/42699

Get alerted when CVE-2026-74865 or the next vulnerability affects your stack