Vulnerabilities in YunoHost-Apps sogo_yhn software

CERT Polska has received a report about vulnerabilities in YunoHost-Apps sogo_yhn software and participated in coordination of their disclosure.

The vulnerabilityCVE-2026-74864: sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user, including a privileged user, without providing a password.

The vulnerabilityCVE-2026-74865: sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's account.

These issues were fixed in version 5.8.0~ynh9.

We thank Przemysław Knycz from WeKrwi.IT (https://github.com/djrzulf) for the responsible vulnerability report.