CVE-2026-121730

MediumCVSS 6.5/10Last modified Nov 12, 2026

Description

emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organization to external recipients.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Nov 3, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1217318.8RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL CVE-2026-1217322.7RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments CVE-2026-1217335.4Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the R CVE-2026-1217346.5ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspac CVE-2026-1217353.7blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm acco CVE-2026-1217365.3NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unau CVE-2026-121737When a remote, unauthenticated HTTP/1.1 client pipelined the start of a second request and then stopped reading, proxygen's coroutine-based CVE-2026-121748.8A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the function snprintf of the file /web/cgi-bin/gre CVE-2026-1217417.8Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute CVE-2026-1217427.8Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu CVE-2026-1217437.8Ashlar-Vellum Cobalt AR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attack CVE-2026-1217447.8Ashlar-Vellum Cobalt XE File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attac