SOGo | BTS - Issues

0006209: HTML ckeditor content truncated on forward if header reference

Tue, 12 May 2026 12:59:27 +0000

It seams that a forward on a mail wich is already a response (to list?) truncate html from previous content.

If we edit HTML directly in source, content is ok. It seems to be related to ckeditor.

No probl with reply on the same mail.

0006208: Search results show corrupted HTML/CSS content

Tue, 12 May 2026 05:48:35 +0000

Following on from https://bugs.sogo.nu/view.php?id=6200, I am still seeing incorrect presentation of HTML content on searched emails.
Attached examples - OK when the email is read in sequence in folder, Not OK when searched for and read.

0006203: Build packages for Ubuntu 26.04 LTS

Mon, 11 May 2026 08:02:48 +0000

Dear developers,

Ubuntu 26.0t LTS was released[1] on Mar 23th 2026, any plan to build packages for it? And arm64 platform?

[1] https://discourse.ubuntu.com/t/resolute-raccoon-release-notes/59221

0006202: Adding participant to calendar invite received from external user causes invite to be sent using their email address as sender

Sun, 10 May 2026 17:50:03 +0000

(I'm a mailcow user, so I'm using SOGo as part of that install. I assume that this doesn't change anything with regards to this bug report, though.)

I had a meeting in my calendar that was put in my calendar by receiving an invite from a @gmail.com address. I extended that invite by editing the calendar entry in Thunderbird and adding the additional participant's email address. mailcow created a new invite and sent it to the additional participant, using the @gmail.com email address of the original sender (the organizer of the meeting).

This sender address was used both in the message header (From: header) as well as in the envelope of the email message (Return-Path: header).

This is super dangerous to your mail server's reputation, because your mail server sends from an ip address that is not authorized by the original domain's SPF record (gmail.com in this case), nor is the message DKIM-signed. This is typical "spamming" behavior and can cause your mail server's reputation to degrade, with the consequence that you might suffer from future issues sending "legitimate" email to external recipients.

0006201: Calendar invite: email has invalid message id

Sun, 10 May 2026 17:44:30 +0000

When I send a calendar invite, the resulting email message has an invalid message id in the format Message-Id: <ae06c383-0f08-ba0a-682a-4db12d05fb49@example.org>> (note the duplicate "greater than" character!).

The integration is: Thunderbird using CalDav towards my mailcow server. Thunderbird is not sending the invite locally via SMTP, but the mailcow backend creates the invite and sends it.

More details here: https://github.com/mailcow/mailcow-dockerized/issues/7213

0006200: HTML is not rendered on search results

Sun, 10 May 2026 09:55:24 +0000

Message html content is correctly displayed when browsing message list, but is not rendered if the message list is filtered by search criteria.

0006167: Email preview fails when message contains more than 250 embedded HTML tags

Thu, 07 May 2026 12:51:51 +0000

Symptoms:

- Email preview does not render/display correctly
- No errors are shown in the logs
- The email displays correctly when opened in edit mode
- Other email clients (Thunderbird, Roundcube) display the same emails correctly in preview mode

0006168: Signature duplication when switching identities while composing email

Thu, 07 May 2026 12:51:28 +0000

We have identified an issue with signature management when composing emails with accounts that have multiple identities configured.

Symptoms:

- When composing a new email, the default user signature is inserted automatically
- When switching to a different identity, the new identity's signature is added to the message
- The original default signature is NOT removed, resulting in duplicate signatures
- Both the default user signature and the identity-specific signature appear in the email body

Expected behavior:
When switching to a different identity while composing an email, the previous signature should be removed and replaced with the signature associated with the newly selected identity. Only one signature should be present at any time.

0006169: Image signature scaling issue: missing height attribute in style tag causes display problems in other email clients

Wed, 06 May 2026 18:10:00 +0000

We have found a bug related to image scaling in email signatures. When an image is resized within the signature editor, the generated HTML code is incomplete, causing display issues when the email is received by other email clients.

Symptoms:

- When resizing an image in the signature editor, the style tag only includes the width attribute
- The height attribute is missing from the style tag
- The original height attribute remains in the tag
- This causes a mismatch: width from style + height from img tag
- Recipients using other email clients see distorted/broken images due to incorrect aspect ratio

0006172: HTML sanitizer removes clickable area for newsletters using wrapping
Wed, 06 May 2026 18:08:25 +0000
We are SOGo administrators and have received multiple user reports regarding newsletters from well-known companies and media outlets where “Read more” buttons or large clickable areas are not clickable in SOGo, while they work as expected in other mail clients such as Roundcube, Thunderbird, and Gmail.

After analysis, this behavior is caused by SOGo sanitizing HTML patterns where an element wraps a block-level

. When sanitized, the anchor is removed or neutralized, leaving visually styled buttons (usually
elements) without an actual inside, making them non-clickable.

Technically, the HTML in these newsletters is not ideal, as the button text itself is not wrapped in an anchor. Instead, the layout relies on a parent element wrapping a table. Other mail clients apply heuristic rendering and still make the area clickable. SOGo, correctly prioritizing security and standards, does not.

However, from an operational and user-experience perspective, this leads to a recurring issue:
end users cannot interact with legitimate content from widely used senders, and administrators are repeatedly asked to justify why SOGo behaves differently.

Minimal example (simplified)

">https://example.com">

Read more

After sanitization, the is removed or detached, leaving a styled without a clickable link.

0006199: Introduction of Gmail like behavior of pressing of "Enter" key while replying to email with quote.

Tue, 05 May 2026 13:49:03 +0000
SOGo is a UI interface used by mailcow for web access to mail.

When I use SOGo web interface and open a received email in the SOGo editor to reply some email, I see quotas from a previous conversation. When I locate my cursor in the middle of quoted text and press ENTER - it adds new line inside the quoted text and that line becomes a part of the quoted text. SO if I start typing - entered by me text formatted as quota from previous conversation.

When I do similar thing using gmail web interface - instead of creating new line which in SOGo is part of quoted text - gmail web interface creates new line, splitting the quoted text in 2 slices. So I can deliberately reply to some portion of quoted text by just placing the cursor in the middle of the quoted text and pressing ENTER and entering new text. Becasue in Gmail web interface that new text is not part of quoted text, but part of my reply. (I am talking about specific html mark that distinguishes quoted text from text entered by the current editor (human) text).

0006198: Clicking the Reply button causes a logout

Tue, 05 May 2026 12:39:45 +0000
When the Reply button is clicked in a specific email, SOGO generates HTTP requests without cookies (see screenshots).
This results in the user being logged out and redirected to the home page.

0006196: Sorting of subscriptions in calendar changes unintendendedly during the day

Tue, 05 May 2026 12:20:57 +0000
I have several calendars subscribed to and manually sorted in a meaningful way. During the day Sogo reorders these sunscriptions in an unexpected way.
I can reset the order which switches to an aphabetical order.

0004897: Resizing of panes in mail view and spam functionality

Tue, 28 Apr 2026 12:40:58 +0000
So far, I really like SoGo, but I see a couple of fundamental user issues.

1) The three-pane and two-pane mail views both have the same column width for the message list, and there seems to be no way to change this.
As a result, long sender addresses and long subject lines can't be read in full without opening the mail. If I access SoGo WITHOUT a widescreen display, it therefore find it takes a long time to process new mail, as each mail must be opened to view the full sender and subject.

REQUEST - add the ability for users to resize the 3 pane widths.

2) SPAM handling
Is there a way of classifying mail as spam and automatically moving it to a spam folder? I can't find one.

REQUEST A - Add a 'spam' button next to the delete button

REQUEST B - Provide feedback to Zentyal spam filter that the message was classified by the user as spam.

0006195: SOGoMailCustomFromEnabled = NO not enforced server-side

Thu, 23 Apr 2026 10:44:45 +0000
The configuration option
SOGoMailCustomFromEnabled = NO
only disables the From field in the SOGo web UI It does not enforce any server-side validation on the /send endpoint. As a result, any authenticated user can bypass the restriction by directly POSTing to the draft send API with a modified from field in the JSON body, without needing any special tools beyond a browser's built-in DevTools.

0006194: Editing custom reccurences of all day events changes all dates erroneously

Thu, 23 Apr 2026 09:19:01 +0000
When editing all day events, that have custom repeats, editing one of the dates leads to all dates being changed (and none are correct afterwards).

0006193: Interface creates events with custom and time based repetition, but doesn't display the correctly

Thu, 23 Apr 2026 08:49:52 +0000
Changing a reoccurring event from e.g. weekly to custom; adds the custom repetition to the event. On subsequent edits only the custom repetition is shown even though the event continues to contain the weekly repetition. Either the weekly repeats should be removed or converted to custom events on adding the custom repeats or the interface has to reflect that both are contained and both should be editable.

0006192: Clicking the "Reply" button freezes Firefox browser

Wed, 22 Apr 2026 05:45:23 +0000
Hello.
I discovered a bug in SOGo 5.12.7.20260406-1 (Debian 12.12, nightly builds).
SOGo takes a long time to generate a response when I click the "Reply" button in an email with multiple replies (see screenshots attached).
The size of the SOGo JSON response is 75 MB.
The size of the original email is 3.5 MB.
Firefox uses two CPU cores and 3 GB of RAM to process this response.
Please help fix this bug.

0006191: faulty processing of URL property in VEVENT; apparent violation of RFC 5545

Tue, 21 Apr 2026 15:16:19 +0000
Correction: Product Version 5.12.7

Additional Category: Apple iPhone OS
Potential Category: Backend Calendar

Relevant standard: RFC 5545, Secs. 3.6.1 (VEVENT), 3.8.1.1 (ATTACH) and 3.8.4.6 (URL)

A VEVENT may acquire a URL property through editing on a client. This property is exposed in the Web Calendar as a clickable link (functional, no problem). The user notes no difference between a URL and an ATTACH property.

When the VEVENT is modified in the Web Calendar, changing the link in question, the modified link is re-added to the VEVENT as an ATTACH property. If the link does not refer to a (downloadable) document, this appears to violate the standard. The original URL property is preserved, resulting in a total of two links.

On iOS, the "ATTACH-encoded" link is unusable if it does not point to a downloadable document. No browser window opens; an error pops up instead.

Recommendations:

1) In order to stay clearly standards-compliant, a URL property should never be transformed into an ATTACH property.
2) In the form element for adding attachments, replace the label "URL" with "Document URL".

Possible bug resolutions (in ascending complexity):

A) Never touch the URL property, as if it were and X-... property. Do not expose it to users.
B) Treat the URL property as immutable, but show the link to the user (clickable).
C) Allow editing the URL property, but save it back to 'URL' instead of 'ATTACH'.

0006157: Changing passwords with OpenID enabled fails

Tue, 21 Apr 2026 10:56:42 +0000
If I enable OpenId logins to the SOGo web UI and try to change my account's password, the LDAP bind fails with:
Oct 30 23:27:05 sogod [637824]: <0x0x560d1f21dea0[LDAPSource]> NAME:LDAPException REASON:operation bind failed: Invalid credentials (0x31) INFO:{"error_code" = 49; login = "uid=jordi@company.com,ou=people,dc=company,dc=com"; }

The uid should be "jordi", not my email "jordi@company.com".

however, if I disable OpenId and do a normal SOGo login using LDAP, password is changed successfully and the bind uses the correct uid "jordi".

0006190: Can't create new caldav account

Fri, 17 Apr 2026 09:00:18 +0000
Since a few weeks, if a caldav account is set up it still works

But if we try to setup a new account in the os prefs, it validates on a blanck page where the "Calendar" and "Todos"buttons are not shown.

The account is recorded as "Unactive"

It doesn't work.

0006187: Regression with TOTP

Thu, 09 Apr 2026 07:50:11 +0000
While working on updating the FreeBSD port of SOGo, I found a regression in the TOTP verification starting with SOGo 5.12.5 (still present with 5.12.6 and 5.12.7):

When signing-in, after typing correct username and password, a valid TOTP is rejected.
As a result, legitimate users cannot sign-in anymore.

0006189: Unable to enter text when composing an email in the mobile view

Fri, 03 Apr 2026 20:55:36 +0000
When composing an email in mobile view using Firefox Mobile (version 149, though this issue may also occur in older versions), the following problem arises:

It is not possible to enter text into the email text field, regardless of whether the email is being composed in plain text or HTML mode.
The keyboard appears, but no characters are entered. Interestingly, the Enter and Backspace keys still work.
The problem can be resolved by switching to the desktop view - entry is possible there (bug occurs exclusively in the mobile view).
During the initial test in the test system, input worked, but the error occurred after checking/changing/resetting the settings.
Clearing caches and cookies or using incognito mode did not resolve the issue.
Other text fields, such as the search bar in SOGo or forms on other websites, work without issues.
A test in Google Chrome did not reveal any such problems.

0006188: Sieve filter "Tagging" action with "Seen" sets custom keyword instead of \Seen system flag

Thu, 02 Apr 2026 08:50:32 +0000
When creating a mail filter in SOGo's preferences with the "Flag the message with" action set to "Seen", the message doesn't get marked as such. I'm wondering if it should be marked with "\Seen" instead?

0006186: Attachments are not displayed in the preview when forwarding

Wed, 01 Apr 2026 12:58:06 +0000
If an email is forwarded to SOGo from the “Sent” folder in Outlook, the email's content will not be displayed when forwarded from SOGo because CKEditor classifies the text as “unsafe content”