It was discovered that SOGo used the client-supplied Origin header when constructing password reset links. A remote attacker could possibly use this issue to obtain password reset tokens and take over user accounts.

#Sicherheitslücke

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

USN-8993-1: SOGo vulnerability

VERWANDTEARTIKEL

CVE-2026-120955 - MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata

CVE-2026-120678 - mongo-c-driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)

CVE-2026-63494 - AVideo OS Command Injection Vulnerability

CVE-2026-44267 - Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter

CVE-2026-63492 - AVideo OS Command Injection

CVE-2026-44266 - Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels