YunoHost-Apps vulnerabilities
Published CVEs affecting YunoHost-Apps products: 2 record(s), with severity, exploitation and fixes.
CVE-2026-74865
Critical · 9.2
CWE-639 Sep 30, 2026
Authentication Bypass in sogo_yhn
sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's account.
This issue was fixed in version 5.8.0~ynh9.
CVE-2026-74864
Critical · 9.3
CWE-639 Sep 30, 2026
Authentication Bypass in sogo_yhn
sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user, including a privileged user, without providing a password.
This issue was fixed in version 5.8.0~ynh9.