{"id":"CVE-2026-114421","kind":"vulnerability","aliases":["CVE-2026-114421"],"related":[],"title":"SEPPmail Secure Email Gateway: password recovery lets outsiders take over unregistered accounts","description":"SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set a new password, authenticate as that account, and prevent the intended recipient from using it until recovery.","summary":"SEPPmail Secure Email Gateway before 15.1.1 lets password recovery run for a created but unregistered GINA account that has an empty initial password, without adequately checking the person is the owner. A remote attacker who finds such an account can set its password, log in as it, and lock the intended recipient out until recovery.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email","infrastructure","secure-email-gateway","seppmail"],"not_affected_if":["version-15.1.1-or-later"],"how_to_check":"- Check the installed SEPPmail version in the admin interface or the product's version page; the affected range is before `15.1.1`.\n- Review GINA accounts that were created but never registered, looking for any with an empty initial password.","fix":"- Move SEPPmail Secure Email Gateway to `15.1.1` or later.","status":"open","published_at":"2026-11-04T09:17:41+00:00","first_seen_at":"2026-11-04T09:26:09+00:00","triaged_at":"2026-11-04T09:26:47+00:00","updated_at":"2026-11-04T09:26:47+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-04T09:26:47Z","model":"claude-haiku-5-5","output":{"fix":"- Move SEPPmail Secure Email Gateway to `15.1.1` or later.","reach":"internet","title":"SEPPmail Secure Email Gateway: password recovery lets outsiders take over unregistered accounts","impact":"medium","summary":"SEPPmail Secure Email Gateway before 15.1.1 lets password recovery run for a created but unregistered GINA account that has an empty initial password, without adequately checking the person is the owner. A remote attacker who finds such an account can set its password, log in as it, and lock the intended recipient out until recovery.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["seppmail","secure-email-gateway","email"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker takes over a pending GINA account and reads its encrypted mail","analyst_note":"","how_to_check":"- Check the installed SEPPmail version in the admin interface or the product's version page; the affected range is before `15.1.1`.\n- Review GINA accounts that were created but never registered, looking for any with an empty initial password.","plain_action":"","needs_analyst":false,"not_affected_if":["version-15.1.1-or-later"],"who_is_affected":"Organizations running SEPPmail Secure Email Gateway before 15.1.1 that use GINA accounts for recipients. Exposure depends on whether the gateway's recovery flow is reachable from the internet and whether unregistered accounts with empty initial passwords exist. Deployments already on 15.1.1 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000705,"input_tokens":4140,"output_tokens":583,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114421':15A,18A '-2026':14A,17A '15.1.1':31B,86C 'account':12A,42B,64B,96C,114C,123C 'adequ':50B,103C 'attack':59B,109C 'authent':120C 'check':51B 'creat':38B,92C 'cve':13A,16A 'email':3A,19B,23B,28B,83C 'empti':46B,101C 'find':61B 'gateway':4A,24B,29B,84C 'gina':41B,95C 'identifi':111C 'infrastructur':20B 'initi':47B,98C 'intend':76B,127C 'let':7A,32B 'lock':74B 'log':69B 'new':118C 'outsid':8A 'owner':56B 'ownership':105C 'password':5A,33B,48B,68B,88C,99C,119C 'permit':87C 'person':53B 'prevent':125C 'recipi':77B,128C 'recoveri':6A,34B,80B,89C,133C 'remot':58B,107C 'run':35B 'secur':2A,22B,27B,82C 'secure-email-gateway':21B 'seppmail':1A,25B,26B,81C 'set':66B,116C 'take':9A 'unauthent':108C 'unregist':11A,40B,94C 'use':130C 'verifi':104C 'whose':97C 'without':49B,102C","nicknames":[],"mitigations":[],"who_affected":"Organizations running SEPPmail Secure Email Gateway before 15.1.1 that use GINA accounts for recipients. Exposure depends on whether the gateway's recovery flow is reachable from the internet and whether unregistered accounts with empty initial passwords exist. Deployments already on 15.1.1 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["email","high","infrastructure","secureemailgateway","seppmail"],"campaign_type":null,"first_public_at":"2026-11-04T09:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vulnerability@ncsc.ch","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114421","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114421","severity":null,"published_at":"2026-11-04T09:17:41+00:00","modified_at":"2026-11-04T09:17:41+00:00","first_seen_at":"2026-11-04T09:26:09+00:00","fetched_at":"2026-11-04T09:26:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}