Critical severity · published Sep 30, 2026
CVE-2026-74865
Authentication Bypass in sogo_yhn
9.2
CVSS
0.4%
EPSS
No
On KEV
Description
sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's account.
This issue was fixed in version 5.8.0~ynh9.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SO
sogo_yhn · YunoHost-Apps
before 5.8.0~ynh9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-74865
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-74865
third-party-advisory
https://cert.pl/en/posts/2026/09/CVE-2026-74864
issue-tracking
https://forum.yunohost.org/t/sogo-critical-vulnerability-fixed-in-5-8-0-ynh9/42699
More from sogo_yhn
9.3
CVE-2026-74864
Authentication Bypass in sogo_yhn