USN-8993-1: SOGo vulnerability
Publication date
3 November 2026
Overview
SOGo could allow unintended access to user accounts.
Releases
Packages
- sogo - Scalable groupware server
Details
It was discovered that SOGo used the client-supplied Origin header when
constructing password reset links. A remote attacker could possibly use
this issue to obtain password reset tokens and take over user accounts.
It was discovered that SOGo used the client-supplied Origin header when
constructing password reset links. A remote attacker could possibly use
this issue to obtain password reset tokens and take over user accounts.
Update instructions
After a standard system update you need to restart SOGo to make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 26.04 LTS resolute | sogo – 5.12.4-1.2ubuntu0.1~esm2 | ||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.