On this page (7 sections)
Ubuntu has published notice USN-8993-1 for SOGo, the groupware server used for webmail, calendars and contacts. According to Ubuntu's security notice, SOGo used the client-supplied Origin header when it built password reset links, which could let a remote attacker obtain reset tokens and take over user accounts.
If you run SOGo on Ubuntu 26.04 LTS, or host mail and calendar services for other people, this is worth patching soon. The notice gives no CVSS score, so severity is not rated here, but account takeover on a mail system is a serious outcome.
What happened
Ubuntu describes the issue as SOGo using the client-supplied Origin header to construct password reset links. The notice says a remote attacker could possibly use this to obtain password reset tokens and take over user accounts. The wording "could possibly" is Ubuntu's, and the notice does not say whether the flaw is being exploited in the wild.
The notice is the only source available so far. It lists CVE-2026-93453 as the reference, but no CVSS score, attack complexity or upstream SOGo advisory was provided to us, so details beyond Ubuntu's summary are unconfirmed.
Why trusting the Origin header is a problem
A password reset email contains a link with a secret token. The host part of that link should come from the server's own configuration. The Origin header, however, is sent by the client and can be set to anything by whoever makes the request.
If an application copies that value into the reset link, a request made on behalf of a victim can produce an email whose link points to a domain the attacker controls. If the victim clicks it, the token can end up in the attacker's hands. This weakness class is commonly called password reset poisoning. We are describing the general class only; Ubuntu's notice does not detail the exact request flow in SOGo.
Who is affected
- Ubuntu 26.04 LTS systems with the sogo package installed, which is the only release listed in the notice.
- Organizations offering SOGo webmail, calendar or contacts to staff or customers, especially where the login page is reachable from the internet.
- Hosting providers and agencies that run SOGo on behalf of clients.
- Other distributions or manually installed SOGo builds may be affected too, but the research does not say. Check with your distributor or the SOGo project.
How to check your exposure
This read-only command shows the installed and candidate sogo package versions on Ubuntu. Compare the installed version with the fixed version 5.12.4-1.2ubuntu0.1~esm2.
apt-cache policy sogoIf the installed version is older than the fixed one, the system has not received the update. Ubuntu states the fix is available through Ubuntu Pro (ESM Apps), so a machine without Pro attached may not see it from the regular archive.
What to do now
Ubuntu says that after a standard system update you need to restart SOGo so the changes take effect. This first command refreshes package lists and upgrades only the sogo package; run it on the affected server and check that the new version is installed.
sudo apt update && sudo apt install --only-upgrade sogoThis command restarts the service so the fixed code is loaded. The service name below is the common one for the Debian packaging; confirm it on your system first.
sudo systemctl restart sogo0 of 6 done
Detection and monitoring
Because no exploitation details are published, treat any unexplained password reset as worth a look. Check mail logs for reset emails sent to users who did not ask for one, and web server logs for reset requests with unusual Origin values. Exact log fields depend on your reverse proxy setup, so adapt this to your environment.
As a general hardening step (not taken from Ubuntu's notice), make sure the public hostname of your SOGo login is fixed in your reverse proxy and that unexpected Host values are rejected. If you want an outside view of your login pages, the free security headers checker and SSL checker show how the public endpoint looks to visitors, and Webforta Monitor can alert you to certificate and header changes. Neither tells you whether this specific flaw is present.
For wider context on keeping patch work on track, see our guide to small business website security or browse more advisories on the Webforta blog.
Open questions
- No CVSS score or severity rating was provided.
- Exploitation status is not stated in the notice.
- Only Ubuntu 26.04 LTS is listed; other platforms are unconfirmed.
- Ubuntu notes a community fix might become public in the future, so non-Pro users may have to wait.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.