---
id: "CVE-2026-127111"
page: "https://infrastack.ai/live/CVE-2026-127111"
kind: "vulnerability"
aliases: ["CVE-2026-127111"]
title: "SOGo: unlimited secret-answer guessing lets attackers take over accounts"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["groupware", "mail", "package", "self-hosted", "sogo"]
not_affected_if: ["sogo-5.12.13-or-later", "totp-enabled-accounts"]
published_at: "2026-11-12T16:19:07+00:00"
first_seen_at: "2026-11-12T16:44:02+00:00"
updated_at: "2026-11-12T16:45:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127111", "first_seen_at": "2026-11-12T16:44:02+00:00"}]
exploit_sources: []
---

# SOGo: unlimited secret-answer guessing lets attackers take over accounts

Link for people: https://infrastack.ai/live/CVE-2026-127111 (this .md is for agents)

SOGo, a groupware server for mail, calendar and contacts, lacks rate limiting on its password recovery check, so anyone can guess secret-question answers without lockout. An unauthenticated attacker can obtain a recovery token, reset the account password and log in, taking over accounts that do not have TOTP enabled.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SOGo version against the fixed version in the release notes
- Confirm whether TOTP is enabled for user accounts; accounts without it are the exposed ones

## Fix

- SOGo before `5.12.13` is affected; move to `5.12.13` or later

## Timeline

- 2026-11-12T16:44:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127111

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/sogo-before-unauthenticated-password-recovery-brute-force
- [fix] Release notes: github.com https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13

## From the sources

SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint without lockout or rate limiting. Attackers can submit unlimited candidate answers to obtain a valid recovery JWT, then use it to change the account password without the old credential and log in via the connect endpoint, achieving full account takeover on accounts without TOTP enabled.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_