This vulnerability in Emails Catch All allows an attacker with some privileges (low privileges required) to bypass authentication mechanisms by leveraging an alternate path or channel. This bypass can be used to exploit the password recovery functionality, potentially leading to full compromise of user accounts. The vulnerability affects versions up to and including 3.5.3. The CVSS vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to complete compromise of user accounts via password recovery exploitation, impacting confidentiality, integrity, and availability of the affected system. This could allow unauthorized access and control over the Emails Catch All service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are available at this time. Until a patch is released, restrict access to the affected service and monitor for suspicious activity related to password recovery processes.