SOGo password reset flaw allows account takeover; patch available only for Ubuntu Pro

Ubuntu published advisory USN-8993-1 on 3 November 2026 for a vulnerability in SOGo, the groupware and webmail server used for calendars, contacts and email on many self-hosted installations. It affects those running SOGo on Ubuntu 26.04 LTS ("Resolute") to provide webmail services to their clients or organisation.

The issue

The bug, tracked as CVE-2026-93453, concerns the password reset function. According to the Ubuntu advisory, SOGo uses the Origin header supplied by the client to construct the password recovery link sent via email. A remote attacker can therefore manipulate that header and obtain the reset token, potentially taking control of the account.

The official CVE record, published on 18 September 2026, describes the mechanism: SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. The attack requires no credentials: Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastructure, enabling account takeover. The severity score assigned is Base score 8.7 · High on CVSS 4.0 scale.

The upstream project, developed by Alinto, closed the issue with version 5.12.11, released in September 2026.

How to remediate on Ubuntu

The advisory applies to the 26.04 LTS release only. The patched package is sogo version 5.12.4-1.2ubuntu0.1~esm2, but Ubuntu's note specifies it is available only through Ubuntu Pro via ESM Apps: there is not yet an equivalent public build in standard repositories. After updating, the SOGo service must be restarted for changes to take effect.

Those managing SOGo installations on 26.04 LTS without an Ubuntu Pro subscription remain exposed until they either evaluate activating ESM Apps (free for up to 5 machines) or perform a manual upgrade to upstream version 5.12.11 or later, following the SOGo project's instructions.