---
id: "CVE-2026-121730"
kind: "vulnerability"
aliases: ["CVE-2026-121730"]
title: "emailflare: authenticated members can send mail from any sender address"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cloudflare-email", "emailflare", "package", "self-hosted"]
not_affected_if: ["auth-required", "single-user"]
published_at: "2026-11-03T23:17:36+00:00"
first_seen_at: "2026-11-03T23:45:15+00:00"
updated_at: "2026-11-03T23:45:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121730", "first_seen_at": "2026-11-03T23:45:15+00:00"}]
---

# emailflare: authenticated members can send mail from any sender address

emailflare before commit cf31f33 has a missing authorization check on POST /api/inbox/compose. Any logged-in member can set an arbitrary from address, so mail goes out impersonating other users or the organization.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether your deployment runs emailflare and what commit it is built from.
- Look at the `from` handling in the `/api/inbox/compose` route and confirm it is not passed through unchecked.

## Fix

- Move to a commit at or after `cf31f33` (the sources link a patch on GitHub).

## Timeline

- 2026-11-03T23:45:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121730

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/emailflare-before-commit-cf31f33-missing-authorization-via-inbox-compose-endpoint
- [fix] Patch: github.com https://github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618f

## From the sources

emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organization to external recipients.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_