CVE-2025-50340: 
Linux Debian vulnerability analysis and mitigation

An Insecure Direct Object Reference (IDOR) vulnerability was discovered in SOGo Webmail through version 5.6.0. The vulnerability allows an authenticated user to send emails on behalf of other users by manipulating a user-controlled identifier in the email-sending request. This vulnerability was assigned CVE-2025-50340 and was disclosed on August 4, 2025 (NVD). The vulnerability is currently disputed by the vendor (Debian Bug).

The vulnerability has been assigned a CVSS 3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The issue stems from the server's failure to verify whether the authenticated user is authorized to use the specified sender identity in email-sending requests (Ubuntu Security).

If exploited, this vulnerability could lead to unauthorized message delivery as another user, potentially enabling impersonation, phishing, or unauthorized communication within the system. The impact primarily affects the integrity of the email system by allowing authenticated users to spoof sender identities (GitHub POC).

The vendor has disputed this vulnerability, stating that sender verification should be handled at the SMTP server level rather than within SOGo, which functions as an email client. The recommended mitigation is to configure the SMTP server to reject emails if the 'from' address doesn't match the authenticated user's address. Additionally, SPF checks can help prevent spoofing when fake 'from' addresses use different domains (SOGo Mail).

The vulnerability has generated discussion within the security community, with the vendor (SOGo) maintaining that this is a design consideration rather than a security vulnerability. The original researcher, Milad Seddigh, reported this issue in April 2025, but the vendor disputed the classification as a vulnerability, leading to ongoing debate about the appropriate layer for implementing sender verification (SOGo Mail).