{"id":"CVE-2026-121730","kind":"vulnerability","aliases":["CVE-2026-121730"],"related":[],"title":"emailflare: authenticated members can send mail from any sender address","description":"emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organization to external recipients.","summary":"emailflare before commit cf31f33 has a missing authorization check on POST /api/inbox/compose. Any logged-in member can set an arbitrary from address, so mail goes out impersonating other users or the organization.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloudflare-email","emailflare","package","self-hosted"],"not_affected_if":["auth-required","single-user"],"how_to_check":"- Check whether your deployment runs emailflare and what commit it is built from.\n- Look at the `from` handling in the `/api/inbox/compose` route and confirm it is not passed through unchecked.","fix":"- Move to a commit at or after `cf31f33` (the sources link a patch on GitHub).","status":"open","published_at":"2026-11-03T23:17:36+00:00","first_seen_at":"2026-11-03T23:45:15+00:00","triaged_at":"2026-11-03T23:45:35+00:00","updated_at":"2026-11-03T23:45:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T23:45:35Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a commit at or after `cf31f33` (the sources link a patch on GitHub).","reach":"network","title":"emailflare: authenticated members can send mail from any sender address","impact":"medium","summary":"emailflare before commit cf31f33 has a missing authorization check on POST /api/inbox/compose. Any logged-in member can set an arbitrary from address, so mail goes out impersonating other users or the organization.","audience":"developers","category":"package","nicknames":[],"who_cares":["emailflare","cloudflare-email","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated member sends email impersonating any sender to outside recipients","analyst_note":"","how_to_check":"- Check whether your deployment runs emailflare and what commit it is built from.\n- Look at the `from` handling in the `/api/inbox/compose` route and confirm it is not passed through unchecked.\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["single-user","auth-required"],"who_is_affected":"Teams that run emailflare as a self-hosted mail inbox with multiple members who can log in. The compose endpoint passes the from field unchecked to the Cloudflare send call, so any authenticated member can impersonate another sender. Deployments with a single user or no member accounts have less exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000674,"input_tokens":4169,"output_tokens":515,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121730':13A,16A '-2026':12A,15A '/api/inbox/compose':36B,69C 'address':10A,47B,80C 'allow':71C 'arbitrari':45B,85C 'attack':81C 'authent':2A,72C 'author':32B,65C 'call':96C 'cf31f33':28B,61C 'check':33B 'cloudflar':18B,94C 'cloudflare-email':17B 'commit':27B,60C 'contain':62C 'cve':11A,14A 'email':19B 'emailflar':1A,20B,25B,58C 'extern':105C 'field':87C 'goe':50B 'host':24B 'imperson':52B,98C 'log':39B 'logged-in':38B 'mail':6A,49B,76C 'member':3A,41B,73C 'miss':31B,64C 'organ':57B,103C 'packag':21B 'pass':90C 'post':35B,68C 'recipi':106C 'self':23B 'self-host':22B 'send':5A,75C,95C 'sender':9A,79C 'set':43B 'suppli':83C 'uncheck':91C 'user':54B,100C 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Teams that run emailflare as a self-hosted mail inbox with multiple members who can log in. The compose endpoint passes the from field unchecked to the Cloudflare send call, so any authenticated member can impersonate another sender. Deployments with a single user or no member accounts have less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloudflareemail","emailflare","high","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T23:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121730","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121730","severity":null,"published_at":"2026-11-03T23:17:36+00:00","modified_at":"2026-11-03T23:17:36+00:00","first_seen_at":"2026-11-03T23:45:15+00:00","fetched_at":"2026-11-03T23:45:15+00:00","note":null}],"documents":[{"id":61638,"url":"https://github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":61645,"url":"https://www.vulncheck.com/advisories/emailflare-before-commit-cf31f33-missing-authorization-via-inbox-compose-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}