Yunohost-Apps Sogo Yhn vulnerabilities

CVE-2026-74865 [CRITICAL] CWE-639 CVE-2026-74865: sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the passwo sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's account. This issue was fixed in version 5.8.0~ynh9.

CVE-2026-74864 [CRITICAL] CWE-639 CVE-2026-74864: sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-rem sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user, including a privileged user, without providing a pas