SOGo: Improper authentication restriction in password recovery (CVE-2026-127111)

SOGo versions prior to 5.12.13 contain an improper restriction of excessive authentication attempts in the password recovery process. An unauthenticated attacker can repeatedly guess secret-question answers via the passwordRecoveryCheck endpoint without rate limiting or lockout protections. Successful brute-forcing allows the attacker to obtain a recovery JWT, which can then be used to reset an account password without requiring the old credential. This results in full account takeover for accounts not protected by time-based one-time passwords (TOTP).

Attack Chain

1. Attacker identifies a target account with a configured secret question.
2. Attacker interacts with the passwordRecoveryCheck API endpoint.
3. Attacker submits repeated, automated requests containing guessed answers to the secret question.
4. Attacker successfully guesses the correct answer due to a lack of rate limiting.
5. Application issues a recovery JWT to the attacker.
6. Attacker uses the recovery JWT to reset the victim's account password via the password reset functionality.
7. Attacker logs into the target account via the connect endpoint, achieving full account takeover.

Impact

Successful exploitation results in full account takeover for any account that has not enabled TOTP. This allows unauthorized access to sensitive user data and account functions.

Recommendation

Upgrade SOGo to version 5.12.13 or later immediately. For environments where patching cannot occur immediately, monitor web server logs for anomalous volumes of POST requests targeting the passwordRecoveryCheck endpoint from single source IPs.