CVE-2026-121730— emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint

Quick assessment

Copy summary Copy citation

Affected

0xdps emailflare

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在提交 cf31f33 之前，emailflare 的 POST /api/inbox/compose 接口存在缺少权限校验的漏洞，允许已认证成员以任意发件人地址发送邮件。攻击者可提供任意“发件人”（from）字段，该字段未经校验即被传递给 Cloudflare 的发送接口，从而冒充其他用户或整个组织向外部收件人发送邮件。

CVE-2026-121730 affects 0xdps emailflare. No confirmed in-the-wild exploitation; assess based on exposure. 在提交 cf31f33 之前，emailflare 的 POST /api/inbox/compose 接口存在缺少权限校验的漏洞，允许已认证成员以任意发件人地址发送邮件。攻击者可提供任意“发件人”（from）字段，该字段未经校验即被传递给 Cloudflare 的发送接口，从而冒充其他用户或整个组织向外部收件人发送邮件。 CVE-2026-121730 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2026-121730

I. Basic Information for CVE-2026-121730

Affected Products

II. Public POCs for CVE-2026-121730

III. Intelligence Information for CVE-2026-121730

Other References for CVE-2026-121730 (4)

• https://github.com/0xdps/emailflare product
• https://github.com/0xdps/emailflare/blob/d448ea205937a5e82683f89013d4c23159da5b7d/services/inbox-worker/src/routes/inbox/compose.ts technical-description
• https://github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618f patch
• https://www.vulncheck.com/advisories/emailflare-before-commit-cf31f33-missing-authorization-via-inbox-compose-endpoint third-party-advisory

• https://www.cve.org/CVERecord?id=CVE-2026-121730

IV. Related Vulnerabilities