{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/emailflare/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:emailflare:emailflare:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.3,"id":"CVE-2026-121729"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["emailflare (\u003c commit cf31f33)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","access-control","email-security"],"_cs_type":"advisory","_cs_vendors":["emailflare"],"content_html":"\u003cp\u003eThe emailflare inbox service contains a missing authorization flaw in the /api/keys route. Any authenticated user can list, create, or revoke API keys, including global live API keys. This vulnerability allows an attacker to send emails from any domain managed by the platform or disable existing service integrations.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eExploitation allows for unauthorized use of the mail-sending infrastructure (impersonation) and denial of service of legitimate user integrations via the revocation of active keys.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade emailflare to the version including commit cf31f33 or later immediately to patch the authorization logic.\u003c/li\u003e\n\u003cli\u003eAudit existing API keys for unexpected creation or revocation events.\u003c/li\u003e\n\u003cli\u003eReview access logs for non-admin accounts interacting with the /api/keys endpoint.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T00:24:15Z","date_published":"2026-11-04T00:24:15Z","id":"https://feed.craftedsignal.io/briefs/2026-11-emailflare-inbox-auth-bypass/","summary":"An authorization bypass vulnerability in the emailflare inbox service allows authenticated users to manage global API keys, facilitating unauthorized mail relay and service disruption.","title":"emailflare: Missing authorization in inbox service (CVE-2026-121729)","url":"https://feed.craftedsignal.io/briefs/2026-11-emailflare-inbox-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Emailflare","version":"https://jsonfeed.org/version/1.1"}