Back to Security Advisories

SOGo Vulnerability — Ubuntu Security Update (USN-8993-1)

USN-8993-1 fixes CVE-2026-93453 in SOGo on Ubuntu: the groupware used the client-supplied Origin header when constructing password-reset links, letting a remote attacker obtain password reset tokens and take over accounts (CVSS 8.3). Update: sudo apt update && sudo apt upgrade sogo and restart the SOGo service.

High 8.3 CVSS
Ubuntu 20.04 Ubuntu 22.04

What this means under a SharedLicense license

Password-reset token theft is account takeover: the attacker receives the reset link meant for the victim and sets a new password on their groupware account — mail, calendar and contacts included.

  1. Ubuntu Security Notices

  2. USN-8993-1

Publication date

3 November 2026

Overview

SOGo could allow unintended access to user accounts.

Releases


26.04 LTS

Open side navigation

Packages

  • sogo – Scalable groupware server

Details

It was discovered that SOGo used the client-supplied Origin header when
constructing password reset links. A remote attacker could possibly use
this issue to obtain password reset tokens and take over user accounts.

It was discovered that SOGo used the client-supplied Origin header when
constructing password reset links. A remote attacker could possibly use
this issue to obtain password reset tokens and take over user accounts.

Update instructions

After a standard system update you need to restart SOGo to make all the
necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.04

LTS resolute

 sogo – 

5.12.4-1.2ubuntu0.1~esm2

Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Frequently Asked Questions

What is CVE-2026-93453?
It is a password-reset link flaw in SOGo: the application used the client-supplied Origin header when building reset links, so an attacker could steer the token to a host they control and take over the account. CVSS 8.3; fixed in USN-8993-1.
Who is affected?
Ubuntu servers running SOGo groupware (mail, calendar and contact sharing) — any deployment exposing password reset to users.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade sogo and restart the SOGo service; consider invalidating outstanding reset links as a precaution.
How would an attacker steal the reset token?
By triggering a reset for a victim while controlling the Origin header — the generated link points at the attacker's host, and the victim's click delivers the token there for account takeover.

References

Security Advisories

Related Advisories

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System