Вернуться к предупреждениям о безопасности

SOGo Vulnerability — Ubuntu Security Update (USN-8993-1)

USN-8993-1 fixes CVE-2026-93453 in SOGo on Ubuntu: the groupware used the client-supplied Origin header when constructing password-reset links, letting a remote attacker obtain password reset tokens and take over accounts (CVSS 8.3). Update: sudo apt update && sudo apt upgrade sogo and restart the SOGo service.

High 8.3 CVSS
Ubuntu 20.04 Ubuntu 22.04

Что это значит по лицензии SharedLicense

Password-reset token theft is account takeover: the attacker receives the reset link meant for the victim and sets a new password on their groupware account — mail, calendar and contacts included.

  1. Ubuntu Security Notices

  2. USN-8993-1

Publication date

3 November 2026

Overview

SOGo could allow unintended access to user accounts.

Releases


26.04 LTS

Packages

  • sogo – Scalable groupware server

Details

It was discovered that SOGo used the client-supplied Origin header when
constructing password reset links. A remote attacker could possibly use
this issue to obtain password reset tokens and take over user accounts.

It was discovered that SOGo used the client-supplied Origin header when
constructing password reset links. A remote attacker could possibly use
this issue to obtain password reset tokens and take over user accounts.

Update instructions

After a standard system update you need to restart SOGo to make all the
necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.04 LTS resolute sogo –  5.12.4-1.2ubuntu0.1~esm2   Ubuntu Pro Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

References

Часто задаваемые вопросы

What is CVE-2026-93453?
It is a password-reset link flaw in SOGo: the application used the client-supplied Origin header when building reset links, so an attacker could steer the token to a host they control and take over the account. CVSS 8.3; fixed in USN-8993-1.
Who is affected?
Ubuntu servers running SOGo groupware (mail, calendar and contact sharing) — any deployment exposing password reset to users.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade sogo and restart the SOGo service; consider invalidating outstanding reset links as a precaution.
How would an attacker steal the reset token?
By triggering a reset for a victim while controlling the Origin header — the generated link points at the attacker's host, and the victim's click delivers the token there for account takeover.

Источники

Предупреждения о безопасности

Похожие предупреждения

Linux Kernel (HWE) Vulnerabilities — Ubuntu Security Update (USN-9018-2)

2026-11-12

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Проверьте систему на уязвимости

Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.

Проверьте свою систему