CVE-2026-121729

HIGH 8.3

emailflare before commit cf31f33 Missing Authorization via /api/keys Routes

CVSS Score

8.3

EPSS Score

0.0%

EPSS Percentile

0th

emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke existing keys to disable integrations.

CWE	CWE-862
Vendor	0xdps
Product	emailflare
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for 0xdps emailflare

Be the first to know when new high vulnerabilities affecting 0xdps emailflare are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Affected Versions

0xdps / emailflare

0 < cf31f33bbb4a324d5353b8a5db0312fedc19618f

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618f github.com: https://github.com/0xdps/emailflare github.com: https://github.com/0xdps/emailflare/blob/d448ea205937a5e82683f89013d4c23159da5b7d/services/inbox-worker/src/routes/keys.ts vulncheck.com: https://www.vulncheck.com/advisories/emailflare-before-commit-cf31f33-missing-authorization-via-api-keys-routes

Credits

Mansurzhan Mavlankulov Devendra Pratap