Emailflare - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/emailflare/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 00:24:15 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgemailflare: Missing authorization in inbox service (CVE-2026-121729)https://feed.craftedsignal.io/briefs/2026-11-emailflare-inbox-auth-bypass/Wed, 04 Nov 2026 00:24:15 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-emailflare-inbox-auth-bypass/An authorization bypass vulnerability in the emailflare inbox service allows authenticated users to manage global API keys, facilitating unauthorized mail relay and service disruption.The emailflare inbox service contains a missing authorization flaw in the /api/keys route. Any authenticated user can list, create, or revoke API keys, including global live API keys. This vulnerability allows an attacker to send emails from any domain managed by the platform or disable existing service integrations.

Impact

Exploitation allows for unauthorized use of the mail-sending infrastructure (impersonation) and denial of service of legitimate user integrations via the revocation of active keys.

Recommendation

  • Upgrade emailflare to the version including commit cf31f33 or later immediately to patch the authorization logic.
  • Audit existing API keys for unexpected creation or revocation events.
  • Review access logs for non-admin accounts interacting with the /api/keys endpoint.
]]>highadvisoryweb-application-vulnerabilityaccess-controlemail-security