CVE-2026-74865CWE-639

CVE-2026-74865

published September 30, 2026

CVSS
9.2
EPSS
0%
Percentile
30.7
In the wild
Unconfirmed
What it is

sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's account.

This issue was fixed in version 5.8.0~ynh9.

The record
Technical detail
CVSS
9.2 · NONE
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00379 · 30.7th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-30T17:17Z
References (2)
https://cert.pl/en/posts/2026/09/CVE-2026-74864 · [email protected]https://forum.yunohost.org/t/sogo-critical-vulnerability-fixed-in-5-8-0-ynh9/42699 · [email protected]
EPSS history
Timeline
  • 02 OCT 03:46Z
    EPSS moved — → 0%
    epss
  • 30 SEP 12:02Z
    Authentication Bypass in sogo_yhn
    cvelistv5