CVE-2026-114421: Empty initial password permits GINA account takeover
SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set a new password, authenticate as that account, and prevent the intended recipient from using it until recovery.
Event History
Frequently Asked Questions
Which accounts are exposed to takeover?
The affected accounts are created but unregistered GINA accounts whose initial password is empty. An attacker must identify such an account to exploit the issue.
Does exploitation require authentication or user interaction?
No. The vulnerability is remotely exploitable by an unauthenticated attacker, and no user interaction is required.
What can an attacker do after exploiting the issue?
An attacker can set a new password through password recovery, authenticate as the GINA account, and prevent the intended recipient from using that account until it is recovered.
Which versions are affected?
SEPPmail Secure Email Gateway versions before 15.1.1 are affected.