View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0006202SOGoBackend Calendarpublic2026-05-10 17:482026-05-15 19:47
Reporterralfbergs Assigned To 
PriorityhighSeveritymajorReproducibilityalways
Status newResolutionopen 
Product Version5.12.5 
Summary0006202: Adding participant to calendar invite received from external user causes invite to be sent using their email address as sender
Description

(I'm a mailcow user, so I'm using SOGo as part of that install. I assume that this doesn't change anything with regards to this bug report, though.)

I had a meeting in my calendar that was put in my calendar by receiving an invite from a @gmail.com address. I extended that invite by editing the calendar entry in Thunderbird and adding the additional participant's email address. mailcow created a new invite and sent it to the additional participant, using the @gmail.com email address of the original sender (the organizer of the meeting).

This sender address was used both in the message header (From: header) as well as in the envelope of the email message (Return-Path: header).

This is super dangerous to your mail server's reputation, because your mail server sends from an ip address that is not authorized by the original domain's SPF record (gmail.com in this case), nor is the message DKIM-signed. This is typical "spamming" behavior and can cause your mail server's reputation to degrade, with the consequence that you might suffer from future issues sending "legitimate" email to external recipients.

Steps To Reproduce
  1. Create a meeting invite from Gmail to a mailbox on your mailcow.
  2. Accept the invite.
  3. Edit the invite in Thunderbird (using the CalDAV integration towards mailcow), adding an extra recipient.
  4. Trigger the invite in Thunderbird (causing the mailcow backend to create an email invite to the extra recipient)
  5. Observe that the extra recipient receives an email message created and sent by your mailcow installation as described above, i.e. using a sender email address of the original @gmail.com user.
TagsNo tags attached.

Activities

ralfbergs

ralfbergs

2026-05-10 17:50

reporter   ~0018455

Relates to the below original report I made towards the mailcow project:

https://github.com/mailcow/mailcow-dockerized/issues/7214
bahnkonzept

bahnkonzept

2026-05-14 21:38

reporter   ~0018459

Hello,

I filed a similiar ticket (0005607) which could have the same reason more than three years ago - but unfortunately without any reaction, answer or fix in SoGo. For us this the behaviour is annoying but we have to live with it.

With resigned regards,

The Bahnkonzept team from Dresden/Germany
ralfbergs

ralfbergs

2026-05-15 08:14

reporter   ~0018460

Hmmm, I don't see how "your" ticket is similar to mine.

Also, I believe the communications in "your" ticket could be clearer. There's several statements and expectations that can easily be interpreted in different ways, this is why it's hard to understand and comment on. Probably that's why the SOGo guy lost interest...
bahnkonzept

bahnkonzept

2026-05-15 13:01

reporter   ~0018462

Dear #ralfbergs,

Thank you for your feedback, and you may well have a point there.

However, I do think the underlying cause is rather similar in both cases. What we've observed is that when calendar entries contain email addresses that deviate from the usual standard format, SOGo tends to dispatch incorrect mails – and interestingly, the behaviour differs markedly between "your" ticket (0006202) and mine (0005607).

You're quite right about the communication in my ticket not being as clear as it might have been; our apprentice drafted that one, I'm afraid. That said, I don't believe it changes the fundamental issue. Even carefully written tickets – such as 0006085, 0005992, 0006143 or 0006085 for instance – receive no response from SOGo whatsoever, despite their meticulous documentation. What's particularly troubling is that even egregious errors that would be straightforward to remedy elicit no feedback from SOGo at all. This strikes me as rather concerning, to be honest.

Best regards,

The Bahnkonzept team from Dresden/Germany
ralfbergs

ralfbergs

2026-05-15 19:47

reporter   ~0018464

Well, let's see. Let's not forget we're dealing with a "free" product -- and you get what you pay for. Of course, there's different projects with different levels of support and passion... ;-)

This issue here is pretty serious. It can inflict serious harm to users of the product, so I really hope this will be dealt with soon.

Issue History

Date Modified Username Field Change
2026-05-10 17:48 ralfbergs New Issue
2026-05-10 17:50 ralfbergs Note Added: 0018455
2026-05-14 21:38 bahnkonzept Note Added: 0018459
2026-05-15 08:14 ralfbergs Note Added: 0018460
2026-05-15 13:01 bahnkonzept Note Added: 0018462
2026-05-15 19:47 ralfbergs Note Added: 0018464