---
id: "CVE-2026-119705"
kind: "vulnerability"
aliases: ["CVE-2026-119705"]
title: "SerpBear: unauthenticated endpoint lets anyone trigger notification email floods"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["nodejs", "package", "self-hosted", "serpbear", "smtp"]
not_affected_if: ["auth-required-all-routes", "internal-network-only", "version-3.1.1-or-later"]
published_at: "2026-10-30T16:17:51+00:00"
first_seen_at: "2026-10-30T16:31:26+00:00"
updated_at: "2026-10-30T16:32:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119705", "first_seen_at": "2026-10-30T16:31:26+00:00"}]
---

# SerpBear: unauthenticated endpoint lets anyone trigger notification email floods

SerpBear before 3.1.1 exposes /api/notify without checking the user, so anyone on the internet can POST to it and make the app send notification emails. An attacker can exhaust SMTP rate limits, get the mail provider to flag the account, and flood recipients.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SerpBear version in package.json or the deployment image; versions below `3.1.1` are affected.
- Confirm whether `/api/notify` is reachable from the internet without logging in.

## Fix

- SerpBear: move to `3.1.1` or later (per the NVD description).

## Timeline

- 2026-10-30T16:31:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119705

## From the sources

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser() is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust SMTP rate limits, trigger provider abuse flags and flood recipients.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_