emailflare vulnerabilities
CVEs whose affected-version data names the emailflare package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-121729High· 8.3emailflare before commit cf31f33 Missing Authorization via /api/keys Routes
emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key acce…
▾ Twilight0xdps · emailflareEPSS 0.25%via CVEORG
CVE-2026-121730Medium· 6.5emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint
emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passe…
▾ Sunlit0xdps · emailflareEPSS 0.22%via CVEORG