What is GHSA-jfr8-42vv-2p3v?

GHSA-jfr8-42vv-2p3v is a security advisory published by GitHub Security Advisories with Critical severity. sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the...

Which CVE IDs does GHSA-jfr8-42vv-2p3v cover?

GHSA-jfr8-42vv-2p3v covers the following CVE IDs: CVE-2026-74865. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-jfr8-42vv-2p3vCritical

sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the...

Vendor

GitHub Security Advisories

Published

September 30, 2026

Last Modified

September 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-74865 →

📋 Description

sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's account.

This issue was fixed in version 5.8.0~ynh9.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-74865
https://cert.pl/en/posts/2026/09/CVE-2026-74864
https://forum.yunohost.org/t/sogo-critical-vulnerability-fixed-in-5-8-0-ynh9/42699
https://github.com/advisories/GHSA-jfr8-42vv-2p3v