CVE-2026-50167: Kurrier: Authenticated cross-user authorization bypass in Kurrier API
Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use another account's identifiers to read and enumerate webhook and identity resources belonging to that account through apps/worker/server/routes/api/kurrier/webhooks/[id].get.ts, apps/worker/server/routes/api/kurrier/webhooks/index.get.ts, apps/worker/server/routes/api/kurrier/identities/[id].get.ts, and apps/worker/server/routes/api/kurrier/identities/index.get.ts. Anonymous requests and invalid API keys were rejected, and cross-user modification operations were blocked, but affected GET and list operations could expose another user's resource metadata. This issue is fixed in version 1.2.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kurrierto a version that resolves this vulnerability.Fixed in 1.2.4
Event History
Frequently Asked Questions
Which deployments are exposed?
Instances running versions earlier than 1.2.4 are affected. The issue applies to authenticated API requests; anonymous requests and requests using invalid API keys are rejected.
What does an attacker need to exploit this issue?
An attacker needs a valid API key and identifiers for another account's webhook or identity resources. They can use the affected GET and list endpoints to read or enumerate metadata for those resources.
What is the remediation?
Upgrade Kurrier to version 1.2.4, which fixes the missing ownership checks. The provided information does not specify a separate mitigation for deployments that cannot immediately upgrade.
How can I investigate possible exposure?
Review access to the affected webhook and identity GET and list API endpoints for requests made with valid API keys, particularly requests referencing resources from other accounts. The available information does not identify specific logging fields or indicators that conclusively prove exploitation.