# CVE-2026-74864 / CVE-2026-74865: Authentication bypass in YunoHost-Apps sogo_yhn (SOGo proxy-auth trust)

> Two CWE-639 authentication-bypass flaws in the YunoHost-Apps sogo_yhn package (SOGo groupware for YunoHost) let an unauthenticated network attacker log in as any existing user, including administrators, either by sending a forged x-webobjects-remote-user header or by supplying any password over HTTP Basic auth. All versions before 5.8.0~ynh9 are affected; NVD scores them CVSS 4.0 9.3 and 9.2 (CRITICAL).

- **Published:** 2026-09-30T00:00:00Z
- **Last reviewed:** 2026-09-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2816
- **ID:** TL-2026-2816
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-74864, CVE-2026-74865

## Description

CERT Polska (published 2026-09-30, credit Przemysław Knycz / WeKrwi.IT) disclosed two authorization-bypass vulnerabilities (CWE-639, Authorization Bypass Through User-Controlled Key) in sogo_yhn, the YunoHost-Apps (sogo_ynh) package that deploys the SOGo groupware (mail, calendars, address books) on YunoHost self-hosted servers.

CVE-2026-74864: the package configures SOGo so that a request carrying the HTTP header x-webobjects-remote-user is treated as sent by a verified user, with no password validation. Because the Nginx front end does not strip this header from client requests, a remote attacker can supply it directly and access any account, including administrative accounts, without authenticating. NVD scores this CVSS 4.0 9.3 CRITICAL (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H).

CVE-2026-74865: the package enables SOGo with SOGoTrustProxyAuthentication=YES, which bypasses password verification during HTTP Basic authentication. An unauthenticated attacker who knows the username of an existing user can log in with any arbitrary password. NVD scores this CVSS 4.0 9.2 CRITICAL (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H).

Background: SOGo's own documentation states SOGoTrustProxyAuthentication defaults to NO and warns that enabling it lets a misconfigured proxy or network weakness allow user impersonation through injected authentication headers; the setting should only be used where the proxy layer is fully controlled. In the YunoHost package the untrusted client-facing Nginx did not remove the trusted header, which is the root cause. The package's public nginx.conf proxies to 127.0.0.1 and sets other x-webobjects-* headers (server-protocol, remote-host, server-name, server-url, server-port) itself.

The YunoHost forum announced a critical SOGo package fix on 2026-07-29 with technical details embargoed for roughly one month; the fix is SOGo package 5.8.0~ynh9, which requires YunoHost >= 12.1.38 (YunoHost 11 users must upgrade YunoHost first). SSO integration is disabled until migration to SOGo 6. Users who could not upgrade at once were given temporary manual configuration workarounds. No in-the-wild exploitation, public PoC, or network IOCs are stated in any source; CERT Polska gives no CVSS, but NVD lists CVSS 4.0 scores for both CVEs. Impact is full read/write access to a victim mailbox, calendar and contacts, and possibly SOGo administrative functions.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1550 Use Alternate Authentication Material
- T1114 Email Collection
- T1213 Data from Information Repositories

## Sources

- [Vulnerabilities in YunoHost-Apps sogo_yhn software (CERT Polska)](https://cert.pl/en/posts/2026/09/CVE-2026-74864/)
- [NVD - CVE-2026-74864](https://nvd.nist.gov/vuln/detail/CVE-2026-74864)
- [NVD - CVE-2026-74865](https://nvd.nist.gov/vuln/detail/CVE-2026-74865)
- [SOGo critical vulnerability fixed in 5.8.0~ynh9 (YunoHost forum)](https://forum.yunohost.org/t/sogo-critical-vulnerability-fixed-in-5-8-0-ynh9/42699)
- [YunoHost-Apps/sogo_ynh package repository](https://github.com/YunoHost-Apps/sogo_ynh)
- [SOGo Installation Guide - SOGoTrustProxyAuthentication](https://www.sogo.nu/files/docs/SOGoInstallationGuide.html)
- [CVE Record CVE-2026-74864 (cve.org)](https://www.cve.org/CVERecord?id=CVE-2026-74864)
- [CVE Record CVE-2026-74865 (cve.org)](https://www.cve.org/CVERecord?id=CVE-2026-74865)
- [CERT Polska coordinated vulnerability disclosure policy](https://cert.pl/en/cvd/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2816