PT-2025-31860 · Unknown+1 · Sogo Web Mail+1

Millad7 · Published 2025-08-04 · Updated 2025-08-15 · CVE-2025-50340

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SOGo Webmail versions through 5.6.0

Description An Insecure Direct Object Reference (IDOR) vulnerability allows an authenticated user to send emails on behalf of other users by manipulating a user-controlled identifier in the email-sending request. The server does not verify if the authenticated user is authorized to use the specified sender identity, leading to unauthorized message delivery. This can result in impersonation, phishing, or unauthorized communication.

Recommendations Update SOGo Webmail to a version newer than 5.6.0.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-50340

Affected Products

Debian

Sogo Web Mail

References · 14

• 🔥 https://github.com/millad7/SOGo_web_mail-vulnerability-CVE-2025-50340 · Exploit
• https://ubuntu.com/security/CVE-2025-50340 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-50340 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-50340 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-50340 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-50340 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-50340 · Security Note
• https://t.me/CVEtracker/29123 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1952535815227080788 · Twitter Post
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1110604 · Note
• https://t.me/cveNotify/132507 · Telegram Post
• https://twitter.com/CVEnew/status/1952464395067433403 · Twitter Post
• https://sogo.nu · Note
• https://mail-archive.com/users%40sogo.nu/msg34098.html · Note