[ CVE-2026-121729 · Published 3 Nov 2026 ]
Vulnerability in 0xdps emailflare
CVSS 8.3
EPSS <1%No fix listed yet
[ Description ]Official description
emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke existing keys to disable integrations.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.