CVE-2026-127111
SOGo before 5.12.13 Unauthenticated Password Recovery Brute Force
SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint without lockout or rate limiting. Attackers can submit unlimited candidate answers to obtain a valid recovery JWT, then use it to change the account password without the old credential and log in via the connect endpoint, achieving full account takeover on accounts without TOTP enabled.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
What each source reports
CVE List Score used
SOGo before 5.12.13 Unauthenticated Password Recovery Brute Force
SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint without lockout or rate limiting. Attackers can submit unlimited candidate answers to obtain a valid recovery JWT, then use it to change the account password without the old credential and log in via the connect endpoint, achieving full account takeover on accounts without TOTP enabled.
- Record
CVE-2026-127111- CVSS 4.0
- 9.1 Critical
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-307
- Updated
- 2026-11-12
EUVDEUVD-2026-124528
SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint without lockout or rate limiting. Attackers can submit unlimited candidate answers to obtain a valid recovery JWT, then use it to change the account password without the old credential and log in via the connect endpoint, achieving full account takeover on accounts without TOTP enabled.
- Record
EUVD-2026-124528- CVSS 4.0
- 9.1 Critical
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-12
GitHub AdvisoriesGHSA-j27v-488j-289h
SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts...
SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint without lockout or rate limiting. Attackers can submit unlimited candidate answers to obtain a valid recovery JWT, then use it to change the account password without the old credential and log in via the connect endpoint, achieving full account takeover on accounts without TOTP enabled.
- Record
GHSA-j27v-488j-289h- CVSS 4.0
- 9.1 Critical
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-307
- Updated
- 2026-11-12
NVD
SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint without lockout or rate limiting. Attackers can submit unlimited candidate answers to obtain a valid recovery JWT, then use it to change the account password without the old credential and log in via the connect endpoint, achieving full account takeover on accounts without TOTP enabled.
- Record
CVE-2026-127111- CVSS 4.0
- 9.1 Critical
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-307
- Updated
- 2026-11-12
OSV
SOGo before 5.12.13 Unauthenticated Password Recovery Brute Force
SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint without lockout or rate limiting. Attackers can submit unlimited candidate answers to obtain a valid recovery JWT, then use it to change the account password without the old credential and log in via the connect endpoint, achieving full account takeover on accounts without TOTP enabled.
- Record
CVE-2026-127111- CVSS 4.0
- 9.1 Critical
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-307
- Updated
- 2026-11-13
OSVDEBIAN-CVE-2026-127111
SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint without lockout or rate limiting. Attackers can submit unlimited candidate answers to obtain a valid recovery JWT, then use it to change the account password without the old credential and log in via the connect endpoint, achieving full account takeover on accounts without TOTP enabled.
- Record
DEBIAN-CVE-2026-127111- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-13
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sogoDebian:12 | All versions, plus listed versions 5.10.0-15.10.0-25.10.0-35.11.0-15.11.0-2 Show 32 moreShow less5.11.1-15.11.2-15.11.2-25.11.2-35.11.2-45.12.0-15.12.1-15.12.1-25.12.1-35.12.10-15.12.11-15.12.12-15.12.13-15.12.3-15.12.3-25.12.4-15.12.4-1.15.12.4-1.25.12.6-15.12.7-15.12.8-15.12.8-25.12.9-15.8.0-15.8.0-2+deb12u15.8.0-2+deb12u25.8.0-2+deb12u35.8.2-15.8.3-15.8.4-15.9.0-15.9.1-1 | None known |
sogoDebian:13 | All versions, plus listed versions 5.12.1-35.12.1-3+deb13u15.12.1-3+deb13u25.12.1-3+deb13u35.12.10-1 Show 13 moreShow less5.12.11-15.12.12-15.12.13-15.12.3-15.12.3-25.12.4-15.12.4-1.15.12.4-1.25.12.6-15.12.7-15.12.8-15.12.8-25.12.9-1 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| references | OSV | |
| affected, aliases, references | OSV | |
| published | EUVD | |
| published | EUVD | |
| aliases, references | GitHub Advisories | |
| aliases, products, published | EUVD, NVD | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-127111 is a critical vulnerability (CVSS 9.1) in Alinto Sogo, published November 12, 2026. No source lists public exploit code. No source names a fixed version.
References
github.com/Alinto/sogo/releases/tag/SOGo-5.12.13
vulncheck.com/advisories/sogo-before-unauthenticated-password-recovery-brute-force
nvd.nist.gov/vuln/detail/CVE-2026-127111
security-tracker.debian.org/tracker/CVE-2026-127111