Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck
CVE-2026-121730emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint
Medium 6.5
In plain English
A medium-severity missing authorization in emailflare from 0xdps. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 87.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organization to external recipients.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| 0xdps | emailflare | 0 – before cf31f33bbb4a324d5353b8a5db0312fedc19618f |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
- Patch Commit patch
- https://github.com/0xdps/emailflare product
- https://github.com/0xdps/emailflare/blob/d448ea205937a5e82683f89013d4c23159da5b7d/services/inbox-worker/src/routes/inbox/compose.ts technical-description
- VulnCheck Advisory: emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint third-party-advisory