CVE-2023-26428

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of other users could be read even though they are not explicitly shared. We improved permission handling when requesting snippets that are not explicitly shared with other users. No publicly available exploits are known.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Jun 20, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-264295.3Control characters were not removed when exporting user feedback content. This allowed attackers to include unexpected content via user feedCVE-2023-26439.8A vulnerability classified as critical was found in SourceCodester File Tracker Manager System 1.0. This vulnerability affects unknown code CVE-2023-264304.3Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SICVE-2023-264314.3IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers with access to user accCVE-2023-264324.3When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access tCVE-2023-264334.3When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access tCVE-2023-264344.3When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access tCVE-2023-264355.0It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers coCVE-2023-264368.8Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deCVE-2023-264375.3Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: throCVE-2023-264383.1External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cCVE-2023-264397.8The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL