Vulnerability · Published May 11, 2026 · Assigned by GitHub_M
CVE-2026-42865Inbox Zero: Cross-account cleaner email stream exposure
Low 2.3
In plain English
A low-severity information exposure in inbox-zero from elie222. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 4.0)2.3Low
Exploit odds (30 days)0.2%top 86.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis subscription listener, which could deliver thread events for one authenticated account to another authenticated account using the cleaner feature at the same time. This vulnerability is fixed in 2.29.3.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| elie222 | inbox-zero | < 2.29.3 |
Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N