{"id":"EUVD-2026-63668","enisaUuid":"b7c5f736-14e3-34bf-90e9-0574a57d5d85","description":"Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit\u0027s server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go\u0027s ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures websocket.Upgrader.CheckOrigin to return true. A malicious website can request /%61pi/events, skip corsOriginAccessControl(), reach the /api/events WebSocket handler, and receive live message IDs, Message-Id values, sender and recipient fields, subjects, tags, and body snippets from an unauthenticated default Mailpit instance after the user visits the site. This is a regression of the earlier WebSocket origin protection and does not affect deployments protected by --ui-auth-file. This issue is fixed in version 1.30.6.","datePublished":"Aug 20, 2026, 9:29:06 PM","dateUpdated":"Aug 21, 2026, 11:31:27 AM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","references":"https://github.com/axllent/mailpit/security/advisories/GHSA-8r62-w5wh-fc5m\nhttps://github.com/axllent/mailpit/commit/fbe5e006c3f1682b819df58b4a932d7a84920be9\nhttps://github.com/axllent/mailpit/releases/tag/v1.30.6\n","aliases":"CVE-2026-67448\nGHSA-8r62-w5wh-fc5m\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"f246acaf-f589-3682-b728-e785a2b78f04","product":{"name":"mailpit","vendor":{"name":"axllent"}},"product_version":"1.29.0, \u003c 1.30.6"}],"enisaIdVendor":[{"id":"d06b2b5d-8cf1-3c13-8bf0-5a1e2bd13e45","vendor":{"name":"axllent"}}],"enisaIdVulnerability":[{"id":"5b6c669c-84c2-36de-9fe1-8fd63bc731be","vulnerability":{"id":"CVE-2026-67448","description":"Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit\u0027s server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go\u0027s ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures websocket.Upgrader.CheckOrigin to return true. A malicious website can request /%61pi/events, skip corsOriginAccessControl(), reach the /api/events WebSocket handler, and receive live message IDs, Message-Id values, sender and recipient fields, subjects, tags, and body snippets from an unauthenticated default Mailpit instance after the user visits the site. This is a regression of the earlier WebSocket origin protection and does not affect deployments protected by --ui-auth-file. This issue is fixed in version 1.30.6.","datePublished":"Aug 20, 2026, 9:29:06 PM","dateUpdated":"Aug 21, 2026, 11:31:27 AM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","references":"https://github.com/axllent/mailpit/security/advisories/GHSA-8r62-w5wh-fc5m\nhttps://github.com/axllent/mailpit/commit/fbe5e006c3f1682b819df58b4a932d7a84920be9\nhttps://github.com/axllent/mailpit/releases/tag/v1.30.6\n","enisa_id":"EUVD-2026-63668\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Oct 30, 2026, 7:15:59 AM","vulnerabilityProduct":[{"id":"798ac32f-8572-3591-850a-34c230ffaa3b","product":{"name":"mailpit","vendor":{"name":"axllent"}},"product_version":"1.29.0, \u003c 1.30.6"}],"vulnerabilityVendor":[{"id":"b4ef9f75-a05b-34e6-9137-7947c1b3aac4","vendor":{"name":"axllent"}}]}},{"id":"bfca441a-6046-39a5-9061-7dc5802a4381","vulnerability":{"id":"GHSA-8r62-w5wh-fc5m","description":"Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)","datePublished":"Aug 20, 2026, 9:34:58 PM","dateUpdated":"Sep 2, 2026, 11:40:59 PM","baseScore":0.0,"references":"https://github.com/axllent/mailpit/security/advisories/GHSA-8r62-w5wh-fc5m\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-67448\nhttps://github.com/axllent/mailpit/commit/fbe5e006c3f1682b819df58b4a932d7a84920be9\nhttps://github.com/axllent/mailpit\nhttps://github.com/axllent/mailpit/releases/tag/v1.30.6\n","enisa_id":"EUVD-2026-63668\n","aliases":"CVE-2026-67448\nGHSA-8r62-w5wh-fc5m\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:59:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}