Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-74864

Authentication Bypass in sogo_yhn

sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user, including a privileged user, without providing a password. This issue was fixed in version 5.8.0~ynh9.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Yunohost-apps
Products
Sogo Yhn
CVE-2026-74865

Authentication Bypass in sogo_yhn

sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's account. This issue was fixed in version 5.8.0~ynh9.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Yunohost-apps
Products
Sogo Yhn