SOGo vulnerability allows remote account takeover via Origin header manipulation
A flaw in how SOGo constructs password reset links using the client-supplied Origin header could allow remote attackers to steal reset tokens and hijack user accounts.
Summary
A security vulnerability has been identified in the SOGo Scalable Groupware Server, specifically affecting how the application handles password reset requests. The flaw stems from the software's reliance on the client-supplied Origin header when generating links for password resets.
This issue, tracked as CVE-2026-93453, allows a remote attacker to potentially intercept password reset tokens. Successful exploitation could lead to full unauthorized access to user accounts. The fix is currently available for Ubuntu 26.04 LTS users via the Ubuntu Pro ESM Apps repository.
Technical details of CVE-2026-93453
- Vulnerability Class: The defect involves improper validation of the Origin header during the construction of sensitive URLs.
- Attack Vector: A remote attacker can exploit this flaw to manipulate the reset link destination, facilitating the theft of password reset tokens.
- Impact: Successful exploitation results in account takeover, granting unauthorized access to groupware services.
- Mitigation: Users must update the sogo package to version 5.12.4-1.2ubuntu0.1~esm2 and restart the SOGo service to apply the fix.
Why it matters
Because this fix is delivered via Ubuntu Pro's ESM Apps, administrators running Ubuntu 26.04 LTS without an active Pro subscription may remain vulnerable. This highlights the critical role of extended security maintenance for groupware software used in enterprise and organizational environments.
Original reference: ubuntu.com →