CVE-2026-42865

Vulnerability

Overview

Inbox Zero, an AI email assistant, used a shared Redis subscription listener for its cleaner email stream endpoint. Prior to version 2.29.3, this design caused thread events intended for one authenticated user to be delivered to another authenticated user who was also using the cleaner feature simultaneously[1][2]. The root cause was the lack of per-subscription isolation in the Server-Sent Events (SSE) stream implementation.

Exploitation

Scenario

Exploitation required two conditions: the cleaner feature had to be enabled (it was disabled by default in self-hosted deployments and was early-access), and two separately authenticated users had to be using the cleaner at the same time[2]. No additional authentication bypass was needed—the flaw was purely in the event routing logic.

Impact

An attacker who was a legitimate but untrusted user of the same Inbox Zero instance could receive thread events belonging to another user's account. The exposed information could include email thread metadata processed by the cleaner, potentially revealing sensitive email activity. The risk was limited because the feature was opt-in and required concurrent use by both parties.

Mitigation

The issue was fixed in release v2.29.3 by isolating SSE subscriptions per user[1][2]. The fix was implemented in commit 02341923b5460ce9630c4681a9b6461ba466688a. Users are advised to upgrade to version 2.29.3 or later. Self-hosted instances should ensure the cleaner feature is properly configured.