{"id":"CVE-2026-127111","kind":"vulnerability","aliases":["CVE-2026-127111"],"related":[],"title":"SOGo: unlimited secret-answer guessing lets attackers take over accounts","description":"SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint without lockout or rate limiting. Attackers can submit unlimited candidate answers to obtain a valid recovery JWT, then use it to change the account password without the old credential and log in via the connect endpoint, achieving full account takeover on accounts without TOTP enabled.","summary":"SOGo, a groupware server for mail, calendar and contacts, lacks rate limiting on its password recovery check, so anyone can guess secret-question answers without lockout. An unauthenticated attacker can obtain a recovery token, reset the account password and log in, taking over accounts that do not have TOTP enabled.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["groupware","mail","package","self-hosted","sogo"],"not_affected_if":["sogo-5.12.13-or-later","totp-enabled-accounts"],"how_to_check":"- Check the installed SOGo version against the fixed version in the release notes\n- Confirm whether TOTP is enabled for user accounts; accounts without it are the exposed ones","fix":"- SOGo before `5.12.13` is affected; move to `5.12.13` or later","status":"open","published_at":"2026-11-12T16:19:07+00:00","first_seen_at":"2026-11-12T16:44:02+00:00","triaged_at":"2026-11-12T16:45:36+00:00","updated_at":"2026-11-12T16:45:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T16:45:36Z","model":"claude-haiku-5-5","output":{"fix":"- SOGo before `5.12.13` is affected; move to `5.12.13` or later\n- unknown","reach":"internet","title":"SOGo: unlimited secret-answer guessing lets attackers take over accounts","impact":"high","summary":"SOGo, a groupware server for mail, calendar and contacts, lacks rate limiting on its password recovery check, so anyone can guess secret-question answers without lockout. An unauthenticated attacker can obtain a recovery token, reset the account password and log in, taking over accounts that do not have TOTP enabled.","audience":"businesses","category":"package","nicknames":[],"who_cares":["sogo","self-hosted","mail","groupware"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker takes over user accounts and reads mail and calendars","analyst_note":"Confirm whether password recovery is enabled by default and check the release notes at github.com for the exact fixed release and any configuration change.","how_to_check":"- Check the installed SOGo version against the fixed version in the release notes\n- Confirm whether TOTP is enabled for user accounts; accounts without it are the exposed ones\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["sogo-5.12.13-or-later","totp-enabled-accounts"],"who_is_affected":"SOGo servers reachable from the internet or an untrusted network with password recovery enabled and accounts that have secret questions but no TOTP. Internal-only deployments that are not reachable by attackers are lower risk. The sources do not say whether the password recovery feature is enabled by default.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000766,"input_tokens":4663,"output_tokens":600,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-127111':14A,17A '-2026':13A,16A '5.12.13':78C 'account':11A,62B,69B,94C,130C,145C,148C 'achiev':143C 'allow':89C 'answer':5A,49B,102C,117C 'anyon':43B 'attack':8A,54B,91C,112C 'attempt':86C 'authent':85C 'calendar':31B 'candid':116C 'chang':128C 'check':41B 'connect':141C 'contact':33B 'contain':79C 'credenti':135C 'cve':12A,15A 'enabl':75B,151C 'endpoint':106C,142C 'excess':84C 'full':144C 'groupwar':18B,27B 'guess':6A,45B,98C 'host':23B 'improp':81C 'jwt':123C 'lack':34B 'let':7A 'limit':36B,111C 'lockout':51B,108C 'log':65B,137C 'mail':19B,30B 'obtain':56B,119C 'old':134C 'packag':20B 'password':39B,63B,95C,131C 'passwordrecoverycheck':105C 'question':48B,101C 'rate':35B,110C 'recoveri':40B,58B,122C 'repeat':97C 'reset':60B,93C 'restrict':82C 'secret':4A,47B,100C 'secret-answ':3A 'secret-quest':46B,99C 'self':22B 'self-host':21B 'server':28B 'sogo':1A,24B,25B,76C 'submit':114C 'take':9A,67B 'takeov':146C 'token':59B 'totp':74B,150C 'unauthent':53B,90C 'unlimit':2A,115C 'use':125C 'valid':121C 'via':103C,139C 'vulner':87C 'without':50B,107C,132C,149C","nicknames":[],"mitigations":[],"who_affected":"SOGo servers reachable from the internet or an untrusted network with password recovery enabled and accounts that have secret questions but no TOTP. Internal-only deployments that are not reachable by attackers are lower risk. The sources do not say whether the password recovery feature is enabled by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","groupware","mail","package","selfhosted","sogo"],"campaign_type":null,"search_a":"'-127111':14A,17A '-2026':13A,16A 'account':11A 'answer':5A 'attack':8A 'cve':12A,15A 'guess':6A 'let':7A 'secret':4A 'secret-answ':3A 'sogo':1A 'take':9A 'unlimit':2A","search_b":"'account':62B,69B 'answer':49B 'anyon':43B 'attack':54B 'calendar':31B 'check':41B 'contact':33B 'enabl':75B 'groupwar':18B,27B 'guess':45B 'host':23B 'lack':34B 'limit':36B 'lockout':51B 'log':65B 'mail':19B,30B 'obtain':56B 'packag':20B 'password':39B,63B 'question':48B 'rate':35B 'recoveri':40B,58B 'reset':60B 'secret':47B 'secret-quest':46B 'self':22B 'self-host':21B 'server':28B 'sogo':24B,25B 'take':67B 'token':59B 'totp':74B 'unauthent':53B 'without':50B","search_c":"'5.12.13':78C 'account':94C,130C,145C,148C 'achiev':143C 'allow':89C 'answer':102C,117C 'attack':91C,112C 'attempt':86C 'authent':85C 'candid':116C 'chang':128C 'connect':141C 'contain':79C 'credenti':135C 'enabl':151C 'endpoint':106C,142C 'excess':84C 'full':144C 'guess':98C 'improp':81C 'jwt':123C 'limit':111C 'lockout':108C 'log':137C 'obtain':119C 'old':134C 'password':95C,131C 'passwordrecoverycheck':105C 'question':101C 'rate':110C 'recoveri':122C 'repeat':97C 'reset':93C 'restrict':82C 'secret':100C 'secret-quest':99C 'sogo':76C 'submit':114C 'takeov':146C 'totp':150C 'unauthent':90C 'unlimit':115C 'use':125C 'valid':121C 'via':103C,139C 'vulner':87C 'without':107C,132C,149C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T16:19:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127111","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127111","severity":null,"published_at":"2026-11-12T16:19:07+00:00","modified_at":"2026-11-12T16:19:07+00:00","first_seen_at":"2026-11-12T16:44:02+00:00","fetched_at":"2026-11-12T16:44:02+00:00","note":null}],"documents":[{"id":136541,"url":"https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":136542,"url":"https://www.vulncheck.com/advisories/sogo-before-unauthenticated-password-recovery-brute-force","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}