CVE-2026-50167— Kurrier: Authenticated cross-user authorization bypass in Kurrier API
Quick assessment
Affected
kurrier-org kurrier
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Kurrier 是一个现代化的、自托管的工作空间，支持电子邮件、日历、联系人和存储功能。在版本 1.2.4 之前，Kurrier 的 API 端点在列出和检索 webhook 及身份（identity）资源时，未对经过身份验证的 API 请求实施资源所有权检查。拥有有效 API 密钥的攻击者可以利用其他账户的标识符，通过以下接口读取和枚举属于这些账户的 webhook 及身份资源： 匿名请求和无效的 API 密钥会被拒绝，跨用户的修改操作也被阻止，但受影响的 GET 和列表操作仍可能泄露其他用户的资源元数据。该问题
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| kurrier-org | kurrier | < 1.2.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-50167
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kurrier: Authenticated cross-user authorization bypass in Kurrier API
Source: CVE Program / CVE List V5
Vulnerability Description
Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use another account's identifiers to read and enumerate webhook and identity resources belonging to that account through apps/worker/server/routes/api/kurrier/webhooks/[id].get.ts, apps/worker/server/routes/api/kurrier/webhooks/index.get.ts, apps/worker/server/routes/api/kurrier/identities/[id].get.ts, and apps/worker/server/routes/api/kurrier/identities/index.get.ts. Anonymous requests and invalid API keys were rejected, and cross-user modification operations were blocked, but affected GET and list operations could expose another user's resource metadata. This issue is fixed in version 1.2.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| kurrier-org | kurrier | < 1.2.4 | - |
|
II. Public POCs for CVE-2026-50167
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-50167
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-50167 (2)
Vendor Advisories for CVE-2026-50167 (1)
Vendor Pages for CVE-2026-50167 (1)
-
🔗 Release v1.2.4 · kurrier-org/kurrier · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same weakness: CWE-639
-
CVE-2026-78466
Fluent Boards Pro <= 2.0.11 - Authenticated (Subscriber+) In -
CVE-2026-10630
WP Courses LMS <= 3.2.29 - Insecure Direct Object Reference -
CVE-2026-5006
Vault Vulnerable to Privilege Escalation via Slash Injection -
CVE-2026-71507
Dolibarr < 24.0.0 REST API Broken Object-Level Authorization -
CVE-2026-71505
Dolibarr < 24.0.0 REST API Broken Object-Level Authorization
V. Comments for CVE-2026-50167
No comments yet