SOGo | BTS - Issues

0006196: Sorting of subscriptions in calendar changes unintendendedly during the day

Thu, 23 Apr 2026 15:51:10 +0000

I have several calendars subscribed to and manually sorted in a meaningful way. During the day Sogo reorders these sunscriptions in an unexpected way.
I can reset the order which switches to an aphabetical order.

0006195: SOGoMailCustomFromEnabled = NO not enforced server-side

Thu, 23 Apr 2026 10:44:45 +0000

The configuration option
SOGoMailCustomFromEnabled = NO
only disables the From field in the SOGo web UI It does not enforce any server-side validation on the /send endpoint. As a result, any authenticated user can bypass the restriction by directly POSTing to the draft send API with a modified from field in the JSON body, without needing any special tools beyond a browser's built-in DevTools.

0006194: Editing custom reccurences of all day events changes all dates erroneously

Thu, 23 Apr 2026 09:19:01 +0000

When editing all day events, that have custom repeats, editing one of the dates leads to all dates being changed (and none are correct afterwards).

0006193: Interface creates events with custom and time based repetition, but doesn't display the correctly

Thu, 23 Apr 2026 08:49:52 +0000

Changing a reoccurring event from e.g. weekly to custom; adds the custom repetition to the event. On subsequent edits only the custom repetition is shown even though the event continues to contain the weekly repetition. Either the weekly repeats should be removed or converted to custom events on adding the custom repeats or the interface has to reflect that both are contained and both should be editable.

0006192: Clicking the "Reply" button freezes Firefox browser

Wed, 22 Apr 2026 05:45:23 +0000

Hello.
I discovered a bug in SOGo 5.12.7.20260406-1 (Debian 12.12, nightly builds).
SOGo takes a long time to generate a response when I click the "Reply" button in an email with multiple replies (see screenshots attached).
The size of the SOGo JSON response is 75 MB.
The size of the original email is 3.5 MB.
Firefox uses two CPU cores and 3 GB of RAM to process this response.
Please help fix this bug.

0006191: faulty processing of URL property in VEVENT; apparent violation of RFC 5545

Tue, 21 Apr 2026 15:16:19 +0000

Correction: Product Version 5.12.7

Additional Category: Apple iPhone OS
Potential Category: Backend Calendar

Relevant standard: RFC 5545, Secs. 3.6.1 (VEVENT), 3.8.1.1 (ATTACH) and 3.8.4.6 (URL)

A VEVENT may acquire a URL property through editing on a client. This property is exposed in the Web Calendar as a clickable link (functional, no problem). The user notes no difference between a URL and an ATTACH property.

When the VEVENT is modified in the Web Calendar, changing the link in question, the modified link is re-added to the VEVENT as an ATTACH property. If the link does not refer to a (downloadable) document, this appears to violate the standard. The original URL property is preserved, resulting in a total of two links.

On iOS, the "ATTACH-encoded" link is unusable if it does not point to a downloadable document. No browser window opens; an error pops up instead.

Recommendations:

1) In order to stay clearly standards-compliant, a URL property should never be transformed into an ATTACH property.
2) In the form element for adding attachments, replace the label "URL" with "Document URL".

Possible bug resolutions (in ascending complexity):

A) Never touch the URL property, as if it were and X-... property. Do not expose it to users.
B) Treat the URL property as immutable, but show the link to the user (clickable).
C) Allow editing the URL property, but save it back to 'URL' instead of 'ATTACH'.

0006157: Changing passwords with OpenID enabled fails

Tue, 21 Apr 2026 10:56:42 +0000

If I enable OpenId logins to the SOGo web UI and try to change my account's password, the LDAP bind fails with:
Oct 30 23:27:05 sogod [637824]: <0x0x560d1f21dea0[LDAPSource]> NAME:LDAPException REASON:operation bind failed: Invalid credentials (0x31) INFO:{"error_code" = 49; login = "uid=jordi@company.com,ou=people,dc=company,dc=com"; }

The uid should be "jordi", not my email "jordi@company.com".

however, if I disable OpenId and do a normal SOGo login using LDAP, password is changed successfully and the bind uses the correct uid "jordi".

0006190: Can't create new caldav account

Fri, 17 Apr 2026 09:00:18 +0000

Since a few weeks, if a caldav account is set up it still works

But if we try to setup a new account in the os prefs, it validates on a blanck page where the "Calendar" and "Todos"buttons are not shown.

The account is recorded as "Unactive"

It doesn't work.

0006187: Regression with TOTP

Thu, 09 Apr 2026 07:50:11 +0000

While working on updating the FreeBSD port of SOGo, I found a regression in the TOTP verification starting with SOGo 5.12.5 (still present with 5.12.6 and 5.12.7):

When signing-in, after typing correct username and password, a valid TOTP is rejected.
As a result, legitimate users cannot sign-in anymore.

0006189: Unable to enter text when composing an email in the mobile view

Fri, 03 Apr 2026 20:55:36 +0000

When composing an email in mobile view using Firefox Mobile (version 149, though this issue may also occur in older versions), the following problem arises:

It is not possible to enter text into the email text field, regardless of whether the email is being composed in plain text or HTML mode.
The keyboard appears, but no characters are entered. Interestingly, the Enter and Backspace keys still work.
The problem can be resolved by switching to the desktop view - entry is possible there (bug occurs exclusively in the mobile view).
During the initial test in the test system, input worked, but the error occurred after checking/changing/resetting the settings.
Clearing caches and cookies or using incognito mode did not resolve the issue.
Other text fields, such as the search bar in SOGo or forms on other websites, work without issues.
A test in Google Chrome did not reveal any such problems.

0006188: Sieve filter "Tagging" action with "Seen" sets custom keyword instead of \Seen system flag

Thu, 02 Apr 2026 08:50:32 +0000

When creating a mail filter in SOGo's preferences with the "Flag the message with" action set to "Seen", the message doesn't get marked as such. I'm wondering if it should be marked with "\Seen" instead?

0006186: Attachments are not displayed in the preview when forwarding

Wed, 01 Apr 2026 12:58:06 +0000

If an email is forwarded to SOGo from the “Sent” folder in Outlook, the email's content will not be displayed when forwarded from SOGo because CKEditor classifies the text as “unsafe content”

0006118: Build packages for CentOS Stream 10?

Sat, 28 Mar 2026 14:06:59 +0000

Dear all,

CentOS Stream 10 was released in Dec 2024, any plan to build packages for it?

0006185: No more arm64 packages for Ubuntu 24.04 (noble)?

Thu, 26 Mar 2026 23:24:59 +0000

It was fine with apt repo for Ubuntu 24.04:
```
deb https://packagingv2.sogo.nu/sogo-nightly-ubuntu/ noble main
```

But`apt update` reports error yesterday:

> N: Skipping acquire of configured file 'main/binary-arm64/Packages' as repository 'https://packagingv2.sogo.nu/sogo-nightly-ubuntu noble InRelease' doesn't support architecture 'arm64'

Questions:

- Did SOGo team remove the arm64 packages?
- Also, any plan to build packages for upcoming Ubuntu 26.04 (resolute)? It's scheduled to be released on April 27th.

0006184: Shortcut for sending mail

Thu, 26 Mar 2026 12:56:44 +0000

There is a nice list of keyboard shortcuts for differents jobs. But for sending a composed mail I have to click with my mouse. Is there a chance to have a shortcut? In other systems (Thunderbird) Ctl+Enter is implemented.

0006183: sending mail to all participants of an event misses organizer

Thu, 26 Mar 2026 09:29:02 +0000

When I open in the webclient an event I am invited to and use the the mail icon in this event to send a mail to all participants the organizer of the meeting is missing in the recipients list of the email. I testet this with our setup and the sogo demo server.

0006062: Repeated events - exceptions

Tue, 24 Mar 2026 10:51:05 +0000

Hello,
Some of our users have a problem with a slow calendar. I found that the problem is in recurring events witch exceptions. In the backup i found an event where there are 46513 EXDATE lines. An example is attached. The EXDATE lines are duplicated. When this user views the calendar, the sogod process consumes 6GB of RAM. Could you please tell me what is wrong a how to fix it?

0006182: Save button disabled on Mail settings page

Mon, 23 Mar 2026 15:14:18 +0000

Build version @56d874c68700 202603150806 according to devtools in prod.

In Hungarian locale the date picker creates date like this: 2026.Már.23.
The dot at the end invalidates this, I believe because of UI/WebServerResources/js/Preferences/Preferences.service.js:237 where a regex filters it. This makes the preferencesForm invalid, and thus the save button remains disabled - for the entire mail settings tab, even when the date wouldn't be relevant, because the default date there is invalid too, blocking the save button for the entire tab regardless of anything.
This would be the same for any other locales where a dot is at the end of the date.

Not sure which solution is the best:
- Either modify the regex to allow the dot (but idk if there are other reasons to invalidate a dot at the end)
- or modify the datepicker and defaults to remove the dot at the end in all relevant locales. (Not sure how to do that best, I'm not a programmer.)

0006180: HTML emails from Outlook/Word render incorrectly in SOGo webmail (mso-* CSS)

Wed, 18 Mar 2026 09:04:40 +0000

Hello,

We are running SOGo v5.12.4 as webmail for our clients and have identified a rendering issue with HTML emails generated by Microsoft Outlook/Word.

**Problem:**
Emails composed in Outlook/Word contain proprietary Microsoft CSS properties (mso-*, mso-line-height, mso-margin-top-alt, etc.) that SOGo's HTML viewer does not process.

This results in:
- Excessive whitespace / broken layout in the message body
- In some cases, the message body appears completely blank

0006168: Signature duplication when switching identities while composing email

Tue, 17 Mar 2026 07:57:35 +0000

We have identified an issue with signature management when composing emails with accounts that have multiple identities configured.

Symptoms:

- When composing a new email, the default user signature is inserted automatically
- When switching to a different identity, the new identity's signature is added to the message
- The original default signature is NOT removed, resulting in duplicate signatures
- Both the default user signature and the identity-specific signature appear in the email body

Expected behavior:
When switching to a different identity while composing an email, the previous signature should be removed and replaced with the signature associated with the newly selected identity. Only one signature should be present at any time.

0006181: SOGo OpenID Problem - Redirect URI?

Thu, 12 Mar 2026 07:35:28 +0000

Dear SOGo Team,

While setting up OpenID login for SOGo, I noticed that the required SOGo redirect URI isn't mentioned in any of the instructions. That's why I'm reporting this here, so that this information can be added to the instructions.

As an alternative, I looked up the address in the compound URL of the link that initially leads to the OpenID provider. For example, it looks like this:
"https://sogo.domain.tld/SOGo/"

Buit, isn't something missing?
Because when I access this URI, I end up, as expected, at "https://sogo.domain.tld/SOGo/so" and thus back in the SOGo login window.

And if I enter this address as the redirect URI in the OpenID provider anyway, the OpenID login process logically results in a redirect loop (which eventually terminates).

As a workaround, I then enter this address as the redirect URI in the OpenID provider.
If I add to the address, for example:
"/oauth2/callback" (found somewhere)
or "/SOGo/so/oidc/callback" (found in the mailing list),
...the redirect is rejected as invalid.

Unfortunately, I haven't found anything useful about this problem in the mailing list—only the aforementioned non-functional URIs.

Could someone please confirm what a correct redirect URI would be? Or what else should I consider?

My SOGo is version 5.12.4 (build@9a1f640bd211 202511171326) and is running as a container within a Nethserver 8 container orchestrator.

Otherwise, SOGo is a great piece of software and has been running very reliably for years—excellent!

Regards, Yummiweb

0006179: CardDAV Shared Read only Address books has empty property current-user-privilege-set in discovery

Tue, 10 Mar 2026 11:55:09 +0000

Hello Sogo Team,

I'd Like to report a bug with the CardDAV Implementation for address books that are shared with read only privileges.

System is sogo 5.9.1 using Thunderbird 148 as client.

Thunderbird will get a response in CardDAV calendar discovery that contains a empty current-user-privilege-set instead of the correct read privilege prop. That's why Thunderbird won't show this address book as "addable".

Ways to make Thundebird discover the adress book:

1) If one would override this check in the debug mode of Thunderbird by changing the variables to readable=true. It shows up and is usable perfectly fine (thus showing that it is indeed readable).

2) Also, if the property would be omitted completely (which I did also in the Thunderbird debugger) one is able to discover, add and use the address books just fine.

3) Perfectly correct would be to include the read privilege as shown below.

Example response for a "bad" read only shared address book response:

/SOGo/dav/sharinguser/Contacts/6DDF-6551C400-B-23F36E80/HTTP/1.1 200 OK

http://groupdav.org/"/> xmlns="urn:ietf:params:xml:ns:carddav"/>

Adressbook( <sharinguser@domain.de>)

/SOGo/dav/myuser

Correctly it should be:

'/SOGo/dav/sharinguser/Contacts/6DDF-6551C400-B-23F36E80/HTTP/1.1 200 OK

http://groupdav.org/"/> xmlns="urn:ietf:params:xml:ns:carddav"/>

Adressbook( <sharinguser@domain.de>)

/SOGo/dav/myuser

0006167: Email preview fails when message contains more than 250 embedded HTML tags

Tue, 10 Mar 2026 11:37:52 +0000

Symptoms:

- Email preview does not render/display correctly
- No errors are shown in the logs
- The email displays correctly when opened in edit mode
- Other email clients (Thunderbird, Roundcube) display the same emails correctly in preview mode

0006178: SOGo5 fails to build on opensuse LINUX - NON DOCKER

Fri, 06 Mar 2026 17:22:19 +0000

Hi team,

starting from version 5.12.2 the build of SOGo5 fails.
Last working version was 5.12.1

You switched to libcurl https://github.com/Alinto/sogo/commit/a782424a30cfe8e9c6f2769a45bcdd3498679237#diff-29c8fb0a4a95e2d446edfa1c9ddb2e8f2293a28c0a0d1a7498bca0d6a2772dc1 , and this causes problems here:

0006173: Contact search fails for names starting with umlauts / diacritics (e.g. Ä, Ö)

Wed, 04 Mar 2026 09:27:52 +0000

Hello,

we are seeing an issue with SOGo contact search when contact display names contain multiple umlauts/diacritics, especially when the name starts with an umlaut (e.g. Ä).

It looks like certain partial search terms do not return the expected contact, even though other partial terms or the full name work.

Expected result:
The contact should be returned for all matching partial queries (prefix / substring search), regardless of umlauts/diacritics.

Actual result:
The contact "Aböabc" can be found with:
- "Ab"
- "Abc"
- "öabc"
- "Aböabc"

But it cannot be found with:
- "Abö"
- "bö"
- "öa"
- "öab"

This is confusing but still workable because the contact can be found with the full name.

However, the issue becomes more problematic when the name starts with an umlaut:

Example contact: "Äböa"

Searching for "Äböa" does NOT return the contact.
Only the following searches return it:
- "böa"
- "öa"