CVE-2026-114420: LDAP wildcard injection exposes GINA recipient accounts
Published Nov 4, 2026
·Updated
SEPPmail Secure Email Gateway before 15.1.1 does not neutralize LDAP metacharacters in an unauthenticated account-selection input in its GINA web interface. A remote unauthenticated attacker can enumerate email addresses.
Event History
Nov 4, 2026
CVE Published
via MITRE·08:41 AM
Data Sourced
via MITRE·08:41 AM
DescriptionWeakness
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed?
SEPPmail Secure Email Gateway deployments running a version before 15.1.1 are affected if the GINA web interface is reachable by a remote attacker.
2
What does an attacker need to exploit this issue?
No authentication or user interaction is required. An attacker can send crafted account-selection input containing LDAP metacharacters to the GINA web interface.
3
What can an attacker obtain?
Successful exploitation allows enumeration of email addresses. The provided information does not indicate integrity or availability impact.