Live › vulnerability › CVE-2026-121729
Emailflare's inbox service lets any signed-in member list, create and revoke API keys on its /api/keys routes without the right permission. An attacker can create a global live key that sends mail from any domain, or revoke existing keys to break integrations.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:45 UTC. All times on this page are UTC.
Teams that self-host or run the emailflare inbox service with more than one authenticated member. The API key routes lack an authorization check, so any member can manage keys that send mail for the whole deployment. Deployments with a single trusted user or no member accounts are less exposed.
No product ranges from the sources yet.
cf31f33/api/keys is reachable by ordinary memberscf31f33 (the patch linked in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke existing keys to disable integrations.
This page as .md · .json · in your agent: get_signal("CVE-2026-121729")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.