CVE-2025-50340: SOGo Webmail thru · Insecure Direct Object Reference
Source CVE Database V5
Not known to be exploited · CVSS 4.3 Medium.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 29% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 4 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate this vulnerability, European organizations should implement multi-layered controls beyond relying solely on the SOGo Webmail client. First, enforce strict SMTP server-side sender verification policies such as SPF, DKIM, and DMARC to detect and block unauthorized sender addresses, as recommended by the supplier. Additionally, implement role-based access controls and restrict user permissions within SOGo to minimize the number of users who can send emails on behalf of others. Regularly audit user activities and monitor email logs for anomalous sending patterns indicative of impersonation attempts. Organizations should also consider deploying email security gateways with advanced anti-spoofing and anomaly detection capabilities. Promptly update SOGo Webmail to the latest version once a patch addressing this vulnerability is released. In the interim, educate users about the risks of phishing and impersonation attacks and encourage verification of unexpected or suspicious emails, especially those requesting sensitive actions or information.
Description
An Insecure Direct Object Reference (IDOR) vulnerability was discovered in SOGo Webmail thru 5.6.0, allowing an authenticated user to send emails on behalf of other users by manipulating a user-controlled identifier in the email-sending request. The server fails to verify whether the authenticated user is authorized to use the specified sender identity, resulting in unauthorized message delivery as another user. This can lead to impersonation, phishing, or unauthorized communication within the system. NOTE: this is disputed by the Supplier because the only effective way to prevent this sender spoofing is on the SMTP server, not within a client such as SOGo.