{"id":"CVE-2026-67448","sourceIdentifier":"security-advisories@github.com","published":"2026-08-20T22:17:56.870","lastModified":"2026-10-18T20:10:00.110","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures websocket.Upgrader.CheckOrigin to return true. A malicious website can request /%61pi/events, skip corsOriginAccessControl(), reach the /api/events WebSocket handler, and receive live message IDs, Message-Id values, sender and recipient fields, subjects, tags, and body snippets from an unauthenticated default Mailpit instance after the user visits the site. This is a regression of the earlier WebSocket origin protection and does not affect deployments protected by --ui-auth-file. This issue is fixed in version 1.30.6."},{"lang":"es","value":"Mailpit es una herramienta de prueba de correo electrónico y una API para desarrolladores. Desde la versión 1.29.0 hasta la 1.30.6, el middleware de origen server/server.go de Mailpit verifica la RequestURI sin procesar en busca del prefijo /api/ mientras que el ServeMux de Go enruta utilizando la ruta URL decodificada por porcentaje, y server/websockets/client.go configura websocket.Upgrader.CheckOrigin para devolver verdadero. Un sitio web malicioso puede solicitar /%61pi/events, omitir corsOriginAccessControl(), alcanzar el gestor WebSocket /api/events y recibir IDs de mensajes en vivo, valores de Message-Id, campos de remitente y destinatario, asuntos, etiquetas y fragmentos de cuerpo de una instancia predeterminada de Mailpit no autenticada después de que el usuario visita el sitio. Esto es una regresión de la protección de origen WebSocket anterior y no afecta a las implementaciones protegidas por --ui-auth-file. Este problema está solucionado en la versión 1.30.6."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"axllent","product":"mailpit","versions":[{"version":">= 1.29.0, < 1.30.6","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-21T11:31:14.259713Z","id":"CVE-2026-67448","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-177"},{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-346"}]}],"references":[{"url":"https://github.com/axllent/mailpit/commit/fbe5e006c3f1682b819df58b4a932d7a84920be9","source":"security-advisories@github.com"},{"url":"https://github.com/axllent/mailpit/releases/tag/v1.30.6","source":"security-advisories@github.com"},{"url":"https://github.com/axllent/mailpit/security/advisories/GHSA-8r62-w5wh-fc5m","source":"security-advisories@github.com"}]}