CVE-2026-121730

MEDIUM 6.5

emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organization to external recipients.

CWE	CWE-862
Vendor	0xdps
Product	emailflare
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for 0xdps emailflare

Be the first to know when new medium vulnerabilities affecting 0xdps emailflare are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

0xdps / emailflare

0 < cf31f33bbb4a324d5353b8a5db0312fedc19618f

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618f github.com: https://github.com/0xdps/emailflare github.com: https://github.com/0xdps/emailflare/blob/d448ea205937a5e82683f89013d4c23159da5b7d/services/inbox-worker/src/routes/inbox/compose.ts vulncheck.com: https://www.vulncheck.com/advisories/emailflare-before-commit-cf31f33-missing-authorization-via-inbox-compose-endpoint

Credits

Mansurzhan Mavlankulov Devendra Pratap