Source: sogo Version: 5.12.10-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for sogo. CVE-2026-93453[0]: | SOGo before 5.12.11 constructs password-reset links using the | client-supplied Origin header as the authority, allowing | unauthenticated attackers to redirect recovery tokens to attacker- | controlled domains. Attackers can submit password recovery requests | with a malicious Origin header to have valid password-reset tokens | mailed to victim recovery addresses within links pointing to | attacker infrastructure, enabling account takeover. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-93453 https://www.cve.org/CVERecord?id=CVE-2026-93453 [1] https://www.sogo.nu/news/2026/sogo-v51211-released.html [2] https://github.com/Alinto/sogo/commit/382118a93b6925de2ce7f774abc1865ebea2dbba [3] https://github.com/Alinto/sogo/commit/04a3e9823889acaf6c247b224f5f7a0108f8f829 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
