CVE-2026-121730

    Dashboard / Vulnerabilities / CVE-2026-121730

    CVE-2026-121730

    Published: 3 Nov 2026Last Modified: 8 Nov 2026

    Summary: emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint

    Details: emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organization to external recipients.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121730.json, https://nvd.nist.gov/vuln/detail/CVE-2026-121730, https://www.vulncheck.com/advisories/emailflare-before-commit-cf31f33-missing-authorization-via-inbox-compose-endpoint, https://github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618f, https://github.com/0xdps/emailflare, https://github.com/0xdps/emailflare/blob/d448ea205937a5e82683f89013d4c23159da5b7d/services/inbox-worker/src/routes/inbox/compose.ts

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -cf31f33bbb4a324d5353b8a5db0312fedc19618f

    Affected versions

    s0.0.5
    s0.0.4
    s0.0.3
    s0.0.2
    s0.0.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-121730 | CVE-DB