CVE-2024-23330: tutao tutanota · Server-Side Request Forgery (SSRF)
Affects tutao tutanotaSource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium : upgrade to 119.10 when convenient.
Data as of 26 Oct 2026, 09:15 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 40% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 119.10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 23 Jan 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade tutao/tutanota to 119.10.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHubtutao/tutanotapkg:github/tutao/tutanotaOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
European organizations using Tutanota should immediately upgrade all client installations to version 119.10 or later to apply the official patch. Until the upgrade is complete, users should be educated to avoid opening suspicious HTML emails or emails from unknown senders, especially those containing embedded images or external content. Organizations can implement network-level controls to block or monitor outbound HTTP requests from email clients to untrusted external domains, reducing the risk of data leakage. Additionally, configuring email gateways or security appliances to sanitize incoming emails by removing or disabling external content can provide a protective layer. For high-security environments, consider disabling HTML email rendering entirely or using text-only email clients. Regular auditing and monitoring of email client behavior and network traffic can help detect exploitation attempts. Finally, organizations should review their privacy policies and incident response plans to address potential data exposure incidents stemming from this vulnerability.
Description
Tuta is an encrypted email service. In versions prior to 119.10, an attacker can attach an image in a html mail which is loaded from external resource in the default setting, which should prevent loading of external resources. When displaying emails containing external content, they should be loaded by default only after confirmation by the user. However, it could be recognized that certain embedded images (see PoC) are loaded, even though the "Automatic Reloading of Images" function is disabled by default. The reloading is also done unencrypted via HTTP and redirections are followed. This behavior is unexpected for the user, since the user assumes that external content will only be loaded after explicit manual confirmation. The loading of external content in e-mails represents a risk, because this makes the sender aware that the e-mail address is used, when the e-mail was read, which device is used and expose the user's IP address. Version 119.10 contains a patch for this issue.