CVE-2026-121729

High

Description

emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke existing keys to disable integrations.

SeverityHigh

CVSS8.3

Exploit probability—

Product0xdps Emailflare

PublishedNov 3, 2026

First seenNov 4, 2026

Weakness typeCWE-862Missing authorization

How to fix

Update

0xdps emailflarecf31f33bbb4a324d5353b8a5db0312fedc19618f or later

Patches

github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618f

Affected products

Product	Affected versions	Fixed in
0xdps emailflare	v < cf31f33bbb4a324d5353b8a5db0312fedc19618f	cf31f33bbb4a324d5353b8a5db0312fedc19618f

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.