No VulnCrest analysis published for this CVE yet. Below is the original CNA/NVD description, unmodified.
Description
emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke existing keys to disable integrations.
Exploits & detection
No public PoC or detection template found yet.
Timeline
- Published: 03 Nov 2026
- Last modified upstream: 04 Nov 2026
Sources & licenses
- CVE / CVSS / CWE
- NVD record ↗ (unmodified). This product uses the NVD API but is not endorsed or certified by the NVD. CVE® © The MITRE Corporation.
- Exploitation
- CISA KEV (CC0) · EPSS by FIRST.org
- References used for the analysis
- https://github.com/0xdps/emailflare
- https://github.com/0xdps/emailflare/blob/d448ea205937a5e82683f89013d4c23159da5b7d/services/inbox-worker/src/routes/keys.ts
- https://github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618f
- https://www.vulncheck.com/advisories/emailflare-before-commit-cf31f33-missing-authorization-via-api-keys-routes
- Analysis, summary and remediation
- © VulnCrest