CVE-2026-121730: emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint

Published Nov 3, 2026

Updated

emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organization to external recipients.

Event History

Nov 3, 2026

CVE Published

via MITRE·10:55 PM

Data Sourced

via MITRE·10:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated member can exploit it. No user interaction is required, and the vulnerable endpoint is reachable over the network.

What does an attacker need to do to impersonate another sender?

The attacker submits a POST request to /api/inbox/compose with an arbitrary from field. That value is passed to the Cloudflare send call without authorization checks.

What is the practical impact?

A malicious member can send email to external recipients while impersonating other users or the organization. The vulnerability affects message integrity; no confidentiality or availability impact is indicated by the provided severity vector.

Which versions are affected?

The issue affects emailflare versions before commit cf31f33. The provided data does not identify affected release version numbers.

CVE-2026-121730: emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to impersonate another sender?

What is the practical impact?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to impersonate another sender?

What is the practical impact?

Which versions are affected?