{"id":"CVE-2026-121452","kind":"vulnerability","aliases":["CVE-2026-121452"],"related":[],"title":"bbs-go: SMTP certificate checks disabled, letting network attackers steal mail credentials","description":"bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify outgoing password-reset and verification emails.","summary":"bbs-go skips TLS certificate verification when it sends email through SMTP, so any party that can intercept the connection can impersonate the mail server. An attacker on the network path can capture SMTP login credentials and read or alter password-reset and verification emails.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bbs-go","go","runtime","self-hosted","smtp"],"not_affected_if":["managed-hosting","no-smtp-email"],"how_to_check":"- Check the bbs-go version in use; the sources say versions through `4.4.6` are affected.\n- Search the sendEmail() code path for `InsecureSkipVerify: true` in the Go source or build.","fix":"- Upgrade bbs-go to a version newer than `4.4.6`; the sources do not name the exact fixed release.","status":"open","published_at":"2026-11-03T16:17:24+00:00","first_seen_at":"2026-11-03T16:21:43+00:00","triaged_at":"2026-11-03T16:23:45+00:00","updated_at":"2026-11-03T16:23:45+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-03T16:23:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade bbs-go to a version newer than `4.4.6`; the sources do not name the exact fixed release.","reach":"network","title":"bbs-go: SMTP certificate checks disabled, letting network attackers steal mail credentials","impact":"medium","summary":"bbs-go skips TLS certificate verification when it sends email through SMTP, so any party that can intercept the connection can impersonate the mail server. An attacker on the network path can capture SMTP login credentials and read or alter password-reset and verification emails.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["bbs-go","go","self-hosted","smtp"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"SMTP credentials stolen and reset emails read or altered","analyst_note":"","how_to_check":"- Check the bbs-go version in use; the sources say versions through `4.4.6` are affected.\n- Search the sendEmail() code path for `InsecureSkipVerify: true` in the Go source or build.","plain_action":"","needs_analyst":false,"not_affected_if":["no-smtp-email","managed-hosting"],"who_is_affected":"Any self-hosted bbs-go forum that sends email over SMTP is exposed, since the flaw is in the outgoing mail code. An attacker needs a network position between the server and its mail provider, such as a shared network or a compromised route. Sites that do not send mail through bbs-go can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000692,"input_tokens":4176,"output_tokens":548,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121452':16A,19A '-2026':15A,18A '4.4.6':80C 'allow':88C 'alter':69B 'attack':10A,56B,92C,103C 'auth':112C 'bbs':2A,21B,30B,77C 'bbs-go':1A,20B,29B,76C 'captur':62B,109C 'certif':5A,34B,84C,107C 'check':6A 'connect':49B 'contain':81C 'credenti':13A,65B,113C 'cve':14A,17A 'disabl':7A 'email':39B,75B,124C 'go':3A,22B,23B,31B,78C 'host':27B 'imperson':51B 'improp':83C 'insecureskipverifi':100C 'intercept':47B,94C 'let':8A 'login':64B 'mail':12A,53B 'modifi':117C 'network':9A,59B,90C 'network-posit':89C 'outgo':118C 'parti':44B 'password':71B,120C 'password-reset':70B,119C 'path':60B 'plain':111C 'posit':91C 'present':105C 'read':67B,115C 'reset':72B,121C 'runtim':24B 'self':26B 'self-host':25B 'send':38B 'sendemail':98C 'server':54B 'set':99C 'skip':32B 'smtp':4A,28B,41B,63B,95C,110C 'steal':11A 'tls':33B 'traffic':96C 'true':102C 'valid':85C 'verif':35B,74B,123C 'vulner':86C","nicknames":[],"mitigations":[],"who_affected":"Any self-hosted bbs-go forum that sends email over SMTP is exposed, since the flaw is in the outgoing mail code. An attacker needs a network position between the server and its mail provider, such as a shared network or a compromised route. Sites that do not send mail through bbs-go can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bbsgo","go","high","runtime","selfhosted","smtp"],"campaign_type":null,"first_public_at":"2026-11-03T16:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121452","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121452","severity":null,"published_at":"2026-11-03T16:17:24+00:00","modified_at":"2026-11-03T16:17:24+00:00","first_seen_at":"2026-11-03T16:21:43+00:00","fetched_at":"2026-11-03T16:21:43+00:00","note":null}],"documents":[{"id":58813,"url":"https://github.com/mlogclub/bbs-go/commit/1a06e35fa6314ee2d3ada70685a7afa740baf6f5","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58814,"url":"https://www.vulncheck.com/advisories/bbs-go-through-4.4.6-improper-tls-certificate-validation-in-smtp-email-service","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}