{"id":"CVE-2026-119705","kind":"vulnerability","aliases":["CVE-2026-119705"],"related":[],"title":"SerpBear: unauthenticated endpoint lets anyone trigger notification email floods","description":"SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser() is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust SMTP rate limits, trigger provider abuse flags and flood recipients.","summary":"SerpBear before 3.1.1 exposes /api/notify without checking the user, so anyone on the internet can POST to it and make the app send notification emails. An attacker can exhaust SMTP rate limits, get the mail provider to flag the account, and flood recipients.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nodejs","package","self-hosted","serpbear","smtp"],"not_affected_if":["auth-required-all-routes","internal-network-only","version-3.1.1-or-later"],"how_to_check":"- Check the installed SerpBear version in package.json or the deployment image; versions below `3.1.1` are affected.\n- Confirm whether `/api/notify` is reachable from the internet without logging in.","fix":"- SerpBear: move to `3.1.1` or later (per the NVD description).","status":"open","published_at":"2026-10-30T16:17:51+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","triaged_at":"2026-10-30T16:32:11+00:00","updated_at":"2026-10-30T16:32:11+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T16:32:11Z","model":"claude-haiku-5-5","output":{"fix":"- SerpBear: move to `3.1.1` or later (per the NVD description).","reach":"internet","title":"SerpBear: unauthenticated endpoint lets anyone trigger notification email floods","impact":"low","summary":"SerpBear before 3.1.1 exposes /api/notify without checking the user, so anyone on the internet can POST to it and make the app send notification emails. An attacker can exhaust SMTP rate limits, get the mail provider to flag the account, and flood recipients.","audience":"businesses","category":"package","nicknames":[],"who_cares":["serpbear","self-hosted","smtp","nodejs"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Anonymous users trigger unlimited notification emails from the server","analyst_note":"","how_to_check":"- Check the installed SerpBear version in package.json or the deployment image; versions below `3.1.1` are affected.\n- Confirm whether `/api/notify` is reachable from the internet without logging in.","plain_action":"","needs_analyst":false,"not_affected_if":["internal-network-only","auth-required-all-routes","version-3.1.1-or-later"],"who_is_affected":"Teams that self-host SerpBear before version 3.1.1 and expose it to the internet. The flaw is in the notify API route, which skips the user check, so any instance reachable from outside is exposed to email abuse. Instances kept on a private network or behind authentication for all routes are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000692,"input_tokens":4162,"output_tokens":551,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119705':12A,15A '-2026':11A,14A '/api/notify':27B,95C '3.1.1':25B,68C 'abus':108C 'account':62B 'allow':77C 'anyon':5A,33B 'app':44B 'attack':49B,80C,90C 'authent':72C 'call':89C 'check':29B 'contain':69C 'cve':10A,13A 'domain':99C 'email':8A,47B,84C 'endpoint':3A 'exhaust':51B,102C 'expos':26B 'flag':60B,109C 'flood':9A,64B,111C 'get':55B 'host':20B 'internet':36B 'let':4A 'limit':54B,105C 'mail':57B 'make':42B 'miss':71C 'never':88C 'nodej':16B 'notif':7A,46B,83C 'option':96C 'packag':17B 'pages/api/notify.ts':75C 'paramet':100C 'post':38B,93C 'provid':58B,107C 'rate':53B,104C 'recipi':65B,112C 'remot':78C 'repeat':92C 'self':19B 'self-host':18B 'send':45B 'serpbear':1A,21B,23B,66C 'smtp':22B,52B,103C 'trigger':6A,82C,106C 'unauthent':2A,79C 'user':31B 'verifyus':86C 'vulner':73C 'without':28B","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host SerpBear before version 3.1.1 and expose it to the internet. The flaw is in the notify API route, which skips the user check, so any instance reachable from outside is exposed to email abuse. Instances kept on a private network or behind authentication for all routes are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T16:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119705","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119705","severity":null,"published_at":"2026-10-30T16:17:51+00:00","modified_at":"2026-10-30T16:17:51+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","fetched_at":"2026-10-30T16:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}