emailflare API key routes lack authorization checks
Any member can make a mail-sending key and send mail under any name.
Summary
The /api/keys routes in emailflare skip authorization checks, so any logged-in member can list, create and revoke API keys. An attacker can mint a live key and send mail from any domain.
Affected when
- A member account that can log in to the inbox service
What to do
Update to commit cf31f33 or later. The sources do not name a fixed version number.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen