Hi,

The following vulnerability was published for sogo.

CVE-2026-93453[0]:
| SOGo before 5.12.11 constructs password-reset links using the
| client-supplied Origin header as the authority, allowing
| unauthenticated attackers to redirect recovery tokens to attacker-
| controlled domains. Attackers can submit password recovery requests
| with a malicious Origin header to have valid password-reset tokens
| mailed to victim recovery addresses within links pointing to
| attacker infrastructure, enabling account takeover.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-93453
https://www.cve.org/CVERecord?id=CVE-2026-93453
[1] https://www.sogo.nu/news/2026/sogo-v51211-released.html
[2] https://github.com/Alinto/sogo/commit/382118a93b6925de2ce7f774abc1865ebea2dbba
[3] https://github.com/Alinto/sogo/commit/04a3e9823889acaf6c247b224f5f7a0108f8f829

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
sogo, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1148454@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Peter Wienemann <wiene@debian.org> (supplier of updated sogo package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 11 Oct 2026 19:27:09 +0200
Source: sogo
Architecture: source
Version: 5.12.1-3+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: Debian SOGo Maintainers <pkg-sogo-maintainers@lists.alioth.debian.org>
Changed-By: Peter Wienemann <wiene@debian.org>
Closes: 1142810 1148454
Changes:
 sogo (5.12.1-3+deb13u3) trixie-security; urgency=medium
 .
   * Non-maintainer upload.
   * Add patch to fix a regression introduced by fix for CVE-2026-33550
     (Closes: #1142810)
   * Add patch to fix shell injection by disabling sendmail
   * Add patch to fix SQL injection: properly parse MKCOL request
   * Add patch to fix XSS: escape angularJS directive for description
   * Add patch to add stripAngular to stringWithoutHTMLInjection calls
     This is a follow-up change to the XSS fix escaping angularJS directive.
   * Add patch to fix SSRF: do not transmit og http status to external calendar
   * Add patch to fix CVE-2026-93453: password reset poisoning
     (Closes: 1148454)
   * Add patch to fix XSS: use legitimate sorting value
   * Add patch to fix XSS issues addressed in upstream PR 395
Checksums-Sha1:
 34b71abc31f9191a7f4aaf03e27868d9d0b65c76 2439 sogo_5.12.1-3+deb13u3.dsc
 4bf416da9b0a4b7663df69e4e44f676b2486d9ef 50712 sogo_5.12.1-3+deb13u3.debian.tar.xz
 189f8cc460d7c2eb40a0a397f5b72af67135e7ae 14842 sogo_5.12.1-3+deb13u3_amd64.buildinfo
Checksums-Sha256:
 0783b7e9b480ae663227fe5d73492f7b65550f84af0fce62b732b1ff43f0be51 2439 sogo_5.12.1-3+deb13u3.dsc
 7e33dac0c89426834b12196d5c5b72d2427b62ce927e527828e8d02e63daa34c 50712 sogo_5.12.1-3+deb13u3.debian.tar.xz
 f580352d8ef9d4e174ce300ebfe99cf4be926cad3c662881e8bf2efa2027fa74 14842 sogo_5.12.1-3+deb13u3_amd64.buildinfo
Files:
 680358f33c0865e7c966faa09415f663 2439 mail optional sogo_5.12.1-3+deb13u3.dsc
 ed05fdfb5f510f1e1f64ebec994179a1 50712 mail optional sogo_5.12.1-3+deb13u3.debian.tar.xz
 bd83aad074acf70f53613808082d45f7 14842 mail optional sogo_5.12.1-3+deb13u3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEEBrYs08CqJ6RHEajlAuXO5wyFLHsFAmrPBWlfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDA2
QjYyQ0QzQzBBQTI3QTQ0NzExQThFNTAyRTVDRUU3MEM4NTJDN0IACgkQAuXO5wyF
LHv3GQ/9GUG+v+OUQvF5bLldTMFggyan6UfZ4jy9TNyE62payjKf3AhoI3EXxnKS
YTfBN0ycBY1lH3P/ZmU2mdcCxxVpicOuSC2UIzS1jFkUsCSx9Z6uLF1N+52alq0a
hnXEnUwz7+tChJn0Aj2QSl9rjAH4jYJ7GY56HcOKcZb9cKcnMPPc0OS77nGjDkEr
WIJTWLO5K9SRqpD2JHeUBPSZ8IcEmHgcHEeWTiqQYzVFvpD0mO/QmnlSGnatbsNh
rce/WVlHl4Iz88jrIIKbtMOoon41nO7aMFUoDoUmU31daEc3PE9FiEtidIslylQs
aiNkNzQ8c8RMxPhJS7MDocIkGaBCCj/3szmOGg5WLOcR7sVc/6po33+thCDVrpyR
wtN+5s6tlaT+sN2Bxbs/33UbeJG4D01ExUqGHhTMV8VK9+tS4s2Jjy8j8ZqtB7c8
n+OIFIh3Cy2RETBt99rmYYSzSMj3IwTSnMJ7QSj3vIssjl06hhhwEI2Xl+FWiJ18
yxsbSJnWAXfX81TNDVg7lUGWapvMwTTQ+fj+b3EXtiM+oVm2HO72ZO8VlMz0UeJb
+wbHGWtGvxTxkW+7VsXsQ2jIuHlK+HavuDS7+TrDApcKFREE7PSde66fyySQYAl8
1ViYSay4/hbVLQCgU4i35Pe49CtIoD+0R2DbJvMPlqOk420gP0M=
=YPWx
-----END PGP SIGNATURE-----