A remote, unauthenticated attacker, can enumerate valid user addresses of a SOGo instance by observing the difference in request processing times. When fuzzing the login portal with a list of potential usernames, processing times are 100ms more when a valid username is entered. This, in combination with the host header poisoning vulnerability, which may be used to poison the password reset link sent to the secondary email, as well as the ability to brute force the security questions, increases the severity and likelihood of account compromise.