---
id: CVE-2026-121730
title: >-
  emailflare before commit cf31f33 Missing Authorization via Inbox Compose
  Endpoint
summary: >-
  emailflare before commit cf31f33 contains a missing authorization
  vulnerability in POST /api/inbox/compose that allows authenticated members to
  send mail as any sender address. Attackers can supply an arbitrary from field,
  which is passe…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: 0xdps
product: emailflare
affected:
  - emailflare < cf31f33bbb4a324d5353b8a5db0312fedc19618f
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-07T03:37:28.092337Z'
published: '2026-11-03'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T03:37:35.983Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121730'
references:
  - url: >-
      https://github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618f
    label: Patch Commit
  - url: 'https://github.com/0xdps/emailflare'
  - url: >-
      https://github.com/0xdps/emailflare/blob/d448ea205937a5e82683f89013d4c23159da5b7d/services/inbox-worker/src/routes/inbox/compose.ts
  - url: >-
      https://www.vulncheck.com/advisories/emailflare-before-commit-cf31f33-missing-authorization-via-inbox-compose-endpoint
    label: >-
      VulnCheck Advisory: emailflare before commit cf31f33 Missing Authorization
      via Inbox Compose Endpoint
tags:
  - cve.org
epss: 0.0022
epssPercentile: 0.1268
ingestedAt: '2026-11-05T20:33:06.608Z'
---

## Overview

emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organization to external recipients.

## Affected

- `emailflare < cf31f33bbb4a324d5353b8a5db0312fedc19618f`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.