Live › vulnerability › CVE-2026-121730
emailflare before commit cf31f33 has a missing authorization check on POST /api/inbox/compose. Any logged-in member can set an arbitrary from address, so mail goes out impersonating other users or the organization.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:45 UTC. All times on this page are UTC.
Teams that run emailflare as a self-hosted mail inbox with multiple members who can log in. The compose endpoint passes the from field unchecked to the Cloudflare send call, so any authenticated member can impersonate another sender. Deployments with a single user or no member accounts have less exposure.
No product ranges from the sources yet.
from handling in the /api/inbox/compose route and confirm it is not passed through unchecked.cf31f33 (the sources link a patch on GitHub).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organization to external recipients.
This page as .md · .json · in your agent: get_signal("CVE-2026-121730")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.