{"id":"CVE-2026-121729","kind":"vulnerability","aliases":["CVE-2026-121729"],"related":[],"title":"emailflare: any member can mint or revoke API keys","description":"emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke existing keys to disable integrations.","summary":"Emailflare's inbox service lets any signed-in member list, create and revoke API keys on its /api/keys routes without the right permission. An attacker can create a global live key that sends mail from any domain, or revoke existing keys to break integrations.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email-api","emailflare","package","self-hosted"],"not_affected_if":["commit-cf31f33-or-later","single-user-deployment"],"how_to_check":"- Check whether the deployed emailflare build predates commit `cf31f33`\n- Review who holds an account on the inbox service and whether `/api/keys` is reachable by ordinary members","fix":"- Move to a build at or after commit `cf31f33` (the patch linked in the sources)","status":"open","published_at":"2026-11-03T23:17:36+00:00","first_seen_at":"2026-11-03T23:45:14+00:00","triaged_at":"2026-11-03T23:45:28+00:00","updated_at":"2026-11-03T23:45:28+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T23:45:28Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a build at or after commit `cf31f33` (the patch linked in the sources)","reach":"network","title":"emailflare: any member can mint or revoke API keys","impact":"high","summary":"Emailflare's inbox service lets any signed-in member list, create and revoke API keys on its /api/keys routes without the right permission. An attacker can create a global live key that sends mail from any domain, or revoke existing keys to break integrations.","audience":"developers","category":"package","nicknames":[],"who_cares":["emailflare","self-hosted","email-api"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"any member mints global keys and sends mail from any domain","analyst_note":"","how_to_check":"- Check whether the deployed emailflare build predates commit `cf31f33`\n- Review who holds an account on the inbox service and whether `/api/keys` is reachable by ordinary members\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["single-user-deployment","commit-cf31f33-or-later"],"who_is_affected":"Teams that self-host or run the emailflare inbox service with more than one authenticated member. The API key routes lack an authorization check, so any member can manage keys that send mail for the whole deployment. Deployments with a single trusted user or no member accounts are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000669,"input_tokens":4164,"output_tokens":506,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121729':12A,15A '-2026':11A,14A '/api/keys':42B,82C '/v1/send':106C 'accept':104C 'allow':85C 'api':8A,18B,38B,94C,102C 'attack':49B,96C 'authent':87C 'author':76C 'break':67B 'cf31f33':72C 'commit':71C 'contain':73C 'creat':35B,51B,91C 'cve':10A,13A 'disabl':118C 'domain':61B,112C 'email':17B 'email-api':16B 'emailflar':1A,19B,24B,69C 'exist':64B,115C 'global':53B,100C 'host':23B 'inbox':26B,80C 'integr':68B,119C 'key':9A,39B,55B,65B,95C,103C,116C 'let':28B 'list':34B,90C 'live':54B,101C 'mail':58B,109C 'member':3A,33B,88C 'mint':5A,98C 'miss':75C 'packag':20B 'permiss':47B 'revok':7A,37B,63B,93C,114C 'right':46B 'rout':43B,83C 'self':22B 'self-host':21B 'send':57B,108C 'servic':27B,81C 'sign':31B 'signed-in':30B 'vulner':77C 'without':44B","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host or run the emailflare inbox service with more than one authenticated member. The API key routes lack an authorization check, so any member can manage keys that send mail for the whole deployment. Deployments with a single trusted user or no member accounts are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["emailapi","emailflare","high","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T23:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121729","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121729","severity":null,"published_at":"2026-11-03T23:17:36+00:00","modified_at":"2026-11-03T23:17:36+00:00","first_seen_at":"2026-11-03T23:45:14+00:00","fetched_at":"2026-11-03T23:45:14+00:00","note":null}],"documents":[{"id":61638,"url":"https://github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":61639,"url":"https://www.vulncheck.com/advisories/emailflare-before-commit-cf31f33-missing-authorization-via-api-keys-routes","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}