---
id: "CVE-2026-123664"
page: "https://infrastack.ai/live/CVE-2026-123664"
kind: "vulnerability"
aliases: ["CVE-2026-123664"]
title: "NASA GCN notification service: improper authorization on email recipient handling"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["email-notifications", "gcn.nasa.gov", "nasa-gcn", "other"]
not_affected_if: ["unknown"]
published_at: "2026-11-06T15:17:20+00:00"
first_seen_at: "2026-11-06T15:42:44+00:00"
updated_at: "2026-11-06T15:44:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123664", "first_seen_at": "2026-11-06T15:42:44+00:00"}]
exploit_sources: []
---

# NASA GCN notification service: improper authorization on email recipient handling

Link for people: https://infrastack.ai/live/CVE-2026-123664 (this .md is for agents)

The GCN web service at gcn.nasa.gov has an authorization flaw in its email notification handler, where manipulating the Recipient argument on the /user/email path is improperly authorized. A remote attacker may be able to act on email notification settings they should not control, and a public exploit has been released.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-06T15:42:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123664

## From the sources

A security flaw has been discovered in nasa-gcn gcn.nasa.gov up to b299b562af665878964b981a459f0a9c04b11adf. This issue affects some unknown processing of the file /user/email of the component Email Notification Handler. Performing a manipulation of the argument Recipient results in improper authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The pull request to fix this issue awaits acceptance.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_