High severity7.4NVD Advisory· Published Mar 13, 2018· Updated Jun 17, 2026
CVE-2018-1000089
CVE-2018-1000089
Description
Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK_AUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your Django error reports, an attacker could discover your ANYMAIL_WEBHOOK setting and use this to post fabricated or malicious Anymail tracking/inbound events to your app. This vulnerability appears to have been fixed in v1.4.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
django-anymailPyPI | >= 0.2, < 1.4 | 1.4 |
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/anymail/django-anymail/commit/1a6086f2b58478d71f89bf27eb034ed81aefe5efnvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-qh9x-mc42-vg4gghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2018-1000089ghsaADVISORY
- github.com/anymail/django-anymail/releases/tag/v1.4nvdRelease NotesWEB
- github.com/pypa/advisory-database/tree/main/vulns/django-anymail/PYSEC-2018-46.yamlghsaWEB
News mentions
0No linked articles in our index yet.