Vulnerability · Published Aug 18, 2026 · Assigned by GitHub_M
CVE-2026-50167Kurrier: Authenticated cross-user authorization bypass in Kurrier API
Medium 5.3
In plain English
A medium-severity authorization bypass via user-controlled key in kurrier from kurrier-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Official description
Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use another account's identifiers to read and enumerate webhook and identity resources belonging to that account through apps/worker/server/routes/api/kurrier/webhooks/[id].get.ts, apps/worker/server/routes/api/kurrier/webhooks/index.get.ts, apps/worker/server/routes/api/kurrier/identities/[id].get.ts, and apps/worker/server/routes/api/kurrier/identities/index.get.ts. Anonymous requests and invalid API keys were rejected, and cross-user modification operations were blocked, but affected GET and list operations could expose another user's resource metadata. This issue is fixed in version 1.2.4.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| kurrier-org | kurrier | < 1.2.4 |
Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/kurrier-org/kurrier/security/advisories/GHSA-f7h3-f5vh-3764 x_refsource_CONFIRM
- https://github.com/kurrier-org/kurrier/pull/446 x_refsource_MISC
- https://github.com/kurrier-org/kurrier/commit/22fad36fb1bc79e3038184ddd485fb235217475c x_refsource_MISC
- https://github.com/kurrier-org/kurrier/releases/tag/v1.2.4 x_refsource_MISC