{"id":"EUVD-2026-63668","revision":"493cae8161f34eebb2c4471f402ef6b2","records":[{"revision":"493cae8161f34eebb2c4471f402ef6b2","observedAt":"2026-11-07T14:20:42.131+00:00","statement":{"source":"euvd","id":"EUVD-2026-63668","aliases":["CVE-2026-67448","GHSA-8r62-w5wh-fc5m"],"title":"Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, an…","description":"Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures websocket.Upgrader.CheckOrigin to return true. A malicious website can request /%61pi/events, skip corsOriginAccessControl(), reach the /api/events WebSocket handler, and receive live message IDs, Message-Id values, sender and recipient fields, subjects, tags, and body snippets from an unauthenticated default Mailpit instance after the user visits the site. This is a regression of the earlier WebSocket origin protection and does not affect deployments protected by --ui-auth-file. This issue is fixed in version 1.30.6.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","score":6.5,"severity":null}],"references":["https://github.com/axllent/mailpit/security/advisories/GHSA-8r62-w5wh-fc5m","https://github.com/axllent/mailpit/commit/fbe5e006c3f1682b819df58b4a932d7a84920be9","https://github.com/axllent/mailpit/releases/tag/v1.30.6"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-63668","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 20, 2026, 9:29:06 PM","dateUpdated":"Aug 21, 2026, 11:31:27 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-63668","identifiers":["EUVD-2026-63668","CVE-2026-67448","GHSA-8r62-w5wh-fc5m"]},"retained":false,"historicalAffected":[]}],"coverage":[]}