CVE-2026-121729: emailflare before commit cf31f33 Missing Authorization via /api/keys Routes

Published Nov 3, 2026

Updated

emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke existing keys to disable integrations.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade emailflare to a version that resolves this vulnerability.
Patch cf31f33

Event History

Nov 3, 2026

CVE Published

via MITRE·10:55 PM

Data Sourced

via MITRE·10:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require administrator privileges?

No. Any authenticated member can access the affected /api/keys routes to list, create, or revoke API keys.

What can an attacker do with a key created through the affected routes?

They can mint a global live API key accepted by /v1/send and use it to send mail from any domain. They can also revoke existing keys, which can disable integrations.

Which versions are affected?

emailflare versions before commit cf31f33 are affected. The provided data does not identify release version numbers.

CVE-2026-121729: emailflare before commit cf31f33 Missing Authorization via /api/keys Routes

Remediation

Event History

Frequently Asked Questions

Does exploitation require administrator privileges?

What can an attacker do with a key created through the affected routes?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require administrator privileges?

What can an attacker do with a key created through the affected routes?

Which versions are affected?