Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
SOGo_web_mail-vulnerability-CVE-2025-50340 — Insecure Direct Object Reference (IDOR vulnerability) in SOGo Webmail Allows a user to send emails on behalf of another user. | Kitploit
Tools/GitHubGitHub/millad7/sogo_web_mail-vulnerability-cve-2025-50340
Vulnerability AnalysisImpersonation ToolsWeb Application ExploitationPhishingPenetration TestingEmail Security
GitHubmillad7/sogo_web_mail-vulnerability-cve-2025-50340

SOGo_web_mail-vulnerability-CVE-2025-50340

Insecure Direct Object Reference (IDOR vulnerability) in SOGo Webmail Allows a user to send emails on behalf of another user.

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
View Repository
1 year agoNot yet reviewed

CVE-2025-50340: Insecure Direct Object Reference (IDOR vulnerability) in SOGo Webmail

CVE ID: CVE-2025-50340
Reporter: Milad Seddigh
Product: SOGo
Affected Versions: v5.6.0
Impact: Insecure Direct Object Reference (IDOR vulnerability) → Allows the user to send emails on behalf of another user.

Summary

An Insecure Direct Object Reference (IDOR) vulnerability was discovered in SOGo Webmail, allowing an authenticated user to send emails on behalf of other users by manipulating a user-controlled identifier in the email sending request. The server fails to verify whether the authenticated user is authorized to use the specified sender identity, resulting in unauthorized message delivery as another user. This can lead to impersonation, phishing, or unauthorized communication within the system.

Steps to Reproduce

1- Login to your account. 2- Send an email and intercept your request using Burp Suite. 3- Change the “from” parameter to victim’s email address to send on behalf of victim. 4- The response server shows the success in sending the email on behalf of another user.

Mitigation

Enforce Proper Authorization: Implement strict server-side authorization checks to ensure that users can only perform actions on resources they are explicitly authorized to access. Verify that the authenticated user is the rightful owner of the email identity being used as the sender (from address).

Download Tool