CVE-2026-127111 · Package
NO FIX YET · SEE WHAT TO DO
SOGo, a groupware server for mail, calendar and contacts, lacks rate limiting on its password recovery check, so anyone can guess secret-question answers without lockout. An unauthenticated attacker can obtain a recovery token, reset the account password and log in, taking over accounts that do not have TOTP enabled.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
SOGo servers reachable from the internet or an untrusted network with password recovery enabled and accounts that have secret questions but no TOTP. Internal-only deployments that are not reachable by attackers are lower risk. The sources do not say whether the password recovery feature is enabled by default.
Not affected if sogo-5.12.13-or-later, totp-enabled-accounts
Who cares groupware, mail, self-hosted, sogo
5.12.13 is affected; move to 5.12.13 or laterSOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint without lockout or rate limiting. Attackers can submit unlimited candidate answers to obtain a valid recovery JWT, then use it to change the account password without the old credential and log in via the connect endpoint, achieving full account takeover on accounts without TOTP enabled.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.