Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN927
_____________________________________________________________________

DATE                : 24/09/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S):  Systems running SOGo versions prior to
                                      5.12.11.
  
=====================================================================
https://www.sogo.nu/news/2026/sogo-v51211-released.html
_____________________________________________________________________


SOGo v5.12.11 released
September 14, 2026

The Alinto team is pleased to announce the immediate availability of
SOGo v5.12.11. This is a major release as it fixes security
vulnerabilities.


IMPORTANT

Three major vulnerabilities have been reported and fixed in this
version 5.12.11 or since the nightly of the 13th of September 2026:
sogo_5.12.9.20260810.

Those vulnerabilities affect any previous SOGO version. Please
update as soon as possible

CVE ID will be updated once they’re created

    1 Password reset poisoning -> fixed
    Several XSS injections with malicious mail or request -> fixed

New mandatory setting for password reset

If the password recovery is enabled
SOGoPasswordRecoveryEnabled = YES;, you must set base URLs
that are allowed to be used:

SOGoPasswordRecoveryBaseURLs = ("https://demo.sogo.nu");

or if several frontend use the same backend:

SOGoPasswordRecoveryBaseURLs = ("https://platform1.sogo.nu", "https://platform2.sogo.nu);

Do not end the URLs by ‘/’

No defaults, will throw an error if empty or unset


Thanks

Thanks to the reporter of vulnerabilities:

    Faceless0x7 for the Password reset poisoning.
    Jan from Turingpoint for the reporting the XSS
injections AND fixing them.
    One person (they didn’t answer if we can quote
them or not) for another XSS injection.
    Sébastien MIZRAHI for reviewing and improving
some of the fix.


Regression

Display

Due to the XSS injection fix, webmail display may be
affected. If that’s the case, please report a bug
https://bugs.sogo.nu


Others thing

Features

    junk: add junk action on mail view (3f4f949). You
can also choose the junk icon among a predefined list.
Look for setting mailJunkIcon in the documentation.


Bug Fixes

    core: keep the @import cleanup working in stringWithoutHTMLInjection (8813677)
    db: release db channel after using them (152f44b)
    db: release db channel after using them part 2 (089b50c)
    junk: extend list of junk icon available (012e6ef)
    mail: escape mail data placed in attributes of a
compiled part (045a0b9), closes #115
    mail: stop interpreting iMIP card text fields as
markup (0d66d75)
    pwd: use the proper url for reset password mail
(382118a)
    pwd: use the proper url for reset password mail
part2 (04a3e98)
    sanitization: update regex for html sanitization
(10dc173)
    UI: use legitimate sorting value (d089c40)

Localization

    hu: Update Hungarian translations (1bf1031)

See the complete change log.


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================