The vulnerability is caused by the configuration parameter SOGoTrustProxyAuthentication set to YES, which causes the password to be ignored during HTTP Basic authentication. This allows an attacker who supplies any username that exists in the system to log in with any arbitrary password, giving them full access to that user’s account. The flaw is an instance of CWE-639, representing authorization bypass through user-controlled input. The result is a compromise of confidentiality and potentially the entire account’s data, services, and credentials.

The affected product is the YunoHost Apps sogo_yhn, a SOGo mail and calendar service. Versions prior to the release of 5.8.0~ynh9 contain the vulnerability. The fix is included in version 5.8.0~ynh9 and later.

The CVSS score of 9.2 signals a high severity impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw remotely by connecting to the SOGo web interface with HTTP Basic authentication enabled, providing any username and arbitrary password. The successful exploitation grants full authenticated access to the victim’s account without requiring any further credentials.