Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-121452— bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Service

Quick assessment

Affected

mlogclub bbs-go

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

bbs-go 4.4.6 及以下版本存在证书验证不当的漏洞。由于 sendEmail() 函数将 InsecureSkipVerify 设置为 true，位于网络中间位置的攻击者可拦截 SMTP 流量。攻击者能够出示任意证书，从而窃取 SMTP PLAIN 身份验证凭据，并读取或篡改用于密码重置和账户验证的出站邮件。

CVSS 6.5 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1040 · Network Sniffing T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
mlogclub	bbs-go	`≤ 4.4.6`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Service

Source: CVE Program / CVE List V5

Vulnerability Description

bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify outgoing password-reset and verification emails.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

证书验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
mlogclub	bbs-go	0 ~ 4.4.6	-

II. Public POCs for CVE-2026-121452

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121452

请登录查看更多情报信息。

Other References for CVE-2026-121452 (1)

🔗 GitHub - mlogclub/bbs-go: A lightweight community and Q&A platform for forums, knowledge bases, and discussions.一个轻量级社区和问答平台。 · GitHub Read full article product

Other References for CVE-2026-121452 (4)

https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/services/email_service.go#L86-L113 technical-description
https://github.com/mlogclub/bbs-go/commit/1a06e35fa6314ee2d3ada70685a7afa740baf6f5 patch
https://github.com/mlogclub/bbs-go/issues/310 issue-tracking
https://www.vulncheck.com/advisories/bbs-go-through-4.4.6-improper-tls-certificate-validation-in-smtp-email-service third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121452

IV. Related Vulnerabilities

Same product: bbs-go

Same vendor: mlogclub

Same weakness: CWE-295