CVE-2026-123664 · Other
NO FIX YET
The GCN web service at gcn.nasa.gov has an authorization flaw in its email notification handler, where manipulating the Recipient argument on the /user/email path is improperly authorized. A remote attacker may be able to act on email notification settings they should not control, and a public exploit has been released.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
The flaw is in the Email Notification Handler of the nasa-gcn gcn.nasa.gov project, which the sources describe as a rolling release with no version ranges. Teams running their own copy of the GCN codebase should look at the email notification code path; the sources do not say who else is affected. A pull request to fix it is pending, so no fixed release is stated.
Not affected if unknown
Who cares email-notifications, gcn.nasa.gov, nasa-gcn
Unknown from the sources.
No fix yet, per the sources.
A security flaw has been discovered in nasa-gcn gcn.nasa.gov up to b299b562af665878964b981a459f0a9c04b11adf. This issue affects some unknown processing of the file /user/email of the component Email Notification Handler. Performing a manipulation of the argument Recipient results in improper authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The pull request to fix this issue awaits acceptance.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.