Medium severity6.5NVD Advisory· Published Nov 3, 2026
CVE-2026-121730
CVE-2026-121730
Description
emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organization to external recipients.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <cf31f33
Patches
Vulnerability mechanics
References
3- github.com/0xdps/emailflare/blob/d448ea205937a5e82683f89013d4c23159da5b7d/services/inbox-worker/src/routes/inbox/compose.tsnvd
- github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618fnvd
- www.vulncheck.com/advisories/emailflare-before-commit-cf31f33-missing-authorization-via-inbox-compose-endpointnvd
News mentions
0No linked articles in our index yet.