Skip to content
Threat Feed
Subscribe
high advisory

emailflare: Missing authorization in inbox service (CVE-2026-121729)

An authorization bypass vulnerability in the emailflare inbox service allows authenticated users to manage global API keys, facilitating unauthorized mail relay and service disruption.

CVE search metadata

CVE search record: CVE-2026-121729. Severity: high. CVSS: 8.3. KEV: no. Product: emailflare (< commit cf31f33). Brief: emailflare: Missing authorization in inbox service (CVE-2026-121729). Brief link: https://feed.craftedsignal.io/briefs/2026-11-emailflare-inbox-auth-bypass/

Triage facts

Revision 1
Applicability
emailflare (< commit cf31f33)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 4, 00:24 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

The emailflare inbox service contains a missing authorization flaw in the /api/keys route. Any authenticated user can list, create, or revoke API keys, including global live API keys. This vulnerability allows an attacker to send emails from any domain managed by the platform or disable existing service integrations.

Impact

Exploitation allows for unauthorized use of the mail-sending infrastructure (impersonation) and denial of service of legitimate user integrations via the revocation of active keys.

Recommendation

  • Upgrade emailflare to the version including commit cf31f33 or later immediately to patch the authorization logic.
  • Audit existing API keys for unexpected creation or revocation events.
  • Review access logs for non-admin accounts interacting with the /api/keys endpoint.

Immediate actions

Patch emailflare to commit cf31f33 or later

IT Operations 48h

Threat Hunt

Identify abnormal API key lifecycle management by non-privileged accounts

T1552 high medium confidence hunt now

Data: Web server access logs

Mitigations

Upgrade emailflare inbox service to commit cf31f33 or later

immediate IT Operations

CVE-2026-121729

Detection coverage 1

Detect Potential CVE-2026-121729 Exploitation - Unauthorized API Key Management

high

Detects unauthorized attempts to access or modify API keys in the emailflare inbox service by non-administrative users.

sigma tactics: impact techniques: T1552.001 sources: webserver

Detection queries are available on the platform. Get full rules →