SOGo Vulnerability — Ubuntu Security Update (USN-8993-1)

USN-8993-1 fixes CVE-2026-93453 in SOGo on Ubuntu: the groupware used the client-supplied Origin header when constructing password-reset links, letting a remote attacker obtain password reset tokens and take over accounts (CVSS 8.3). Update: sudo apt update && sudo apt upgrade sogo and restart the SOGo service.

High 8.3 CVSS 2026-11-03

Ubuntu 20.04 Ubuntu 22.04

SharedLicense लाइसेंस के तहत इसका अर्थ

Password-reset token theft is account takeover: the attacker receives the reset link meant for the victim and sets a new password on their groupware account — mail, calendar and contacts included.

Ubuntu Security Notices
USN-8993-1

Publication date

3 November 2026

Overview

SOGo could allow unintended access to user accounts.

Releases

26.04 LTS

Open side navigation

Packages

sogo – Scalable groupware server

Details

It was discovered that SOGo used the client-supplied Origin header when
constructing password reset links. A remote attacker could possibly use
this issue to obtain password reset tokens and take over user accounts.

Update instructions

After a standard system update you need to restart SOGo to make all the
necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release	Package Version
26.04 LTS resolute	sogo – 5.12.4-1.2ubuntu0.1~esm2 Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

Ubuntu Release

Package Version

26.04

LTS resolute

sogo –

5.12.4-1.2ubuntu0.1~esm2

Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

CVE-2026-93453

CVE-2026-93453

अक्सर पूछे जाने वाले प्रश्न

What is CVE-2026-93453?

It is a password-reset link flaw in SOGo: the application used the client-supplied Origin header when building reset links, so an attacker could steer the token to a host they control and take over the account. CVSS 8.3; fixed in USN-8993-1.

Who is affected?

Ubuntu servers running SOGo groupware (mail, calendar and contact sharing) — any deployment exposing password reset to users.

How do I apply the fix?

Run sudo apt update && sudo apt upgrade sogo and restart the SOGo service; consider invalidating outstanding reset links as a precaution.

How would an attacker steal the reset token?

By triggering a reset for a victim while controlling the Origin header — the generated link points at the attacker's host, and the victim's click delivers the token there for account takeover.

संदर्भ

सुरक्षा सलाह

अपने सिस्टम में भेद्यताओं की जाँच करें

अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।

अपना सिस्टम जाँचें