CVE-2026-127111

Name of the Vulnerable Software and Affected Versions SOGo versions prior to 5.12.13

Description An improper restriction of excessive authentication attempts allows unauthenticated attackers to reset account passwords. By repeatedly guessing secret-question answers via the 'passwordRecoveryCheck' endpoint, which lacks lockout or rate limiting, attackers can obtain a valid recovery JWT (JSON Web Token). This token can then be used to change the account password without the original credentials and log in via the 'connect' endpoint, leading to full account takeover for accounts that do not have TOTP (Time-based One-Time Password) enabled.

Recommendations Update SOGo to version 5.12.13.