Live › vulnerability › CVE-2026-119705
SerpBear before 3.1.1 exposes /api/notify without checking the user, so anyone on the internet can POST to it and make the app send notification emails. An attacker can exhaust SMTP rate limits, get the mail provider to flag the account, and flood recipients.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Teams that self-host SerpBear before version 3.1.1 and expose it to the internet. The flaw is in the notify API route, which skips the user check, so any instance reachable from outside is exposed to email abuse. Instances kept on a private network or behind authentication for all routes are less exposed.
No product ranges from the sources yet.
3.1.1 are affected./api/notify is reachable from the internet without logging in.3.1.1 or later (per the NVD description).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser() is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust SMTP rate limits, trigger provider abuse flags and flood recipients.
This page as .md · .json · in your agent: get_signal("CVE-2026-119705")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.