CVE-2026-27492 is a vulnerability categorized under CWE-488 (Exposure of Data Element to Wrong Session) found in the Lettermint Node.js SDK, specifically in versions 1.5.0 and earlier. The root cause is that the SDK does not reset or clear email properties—including 'to', 'subject', 'html', 'text', and 'attachments'—between multiple .send() calls when the same client instance is reused. As a result, data from a prior email send operation can persist and be unintentionally included in subsequent emails. This can cause sensitive information or recipient addresses to leak to unintended recipients, violating confidentiality. The vulnerability primarily affects applications that send multiple emails in sequence, such as password reset flows or notification systems, where different recipients receive different content. Exploitation requires the attacker to have low-level privileges to reuse the same client instance but does not require user interaction. The CVSS v3.1 score is 4.7 (medium severity), reflecting the local attack vector, high confidentiality impact, and low privileges required. No known exploits have been reported in the wild. The issue was addressed in Lettermint Node.js SDK version 1.5.1 by ensuring email properties are properly reset between sends, preventing data leakage.

The primary impact of this vulnerability is the unintended disclosure of sensitive email content and recipient information to unauthorized parties. This can lead to privacy violations, exposure of confidential data, and potential compliance breaches, especially for organizations handling sensitive communications such as password resets, financial notifications, or personal data. The leakage of recipient addresses can also facilitate further phishing or social engineering attacks. While the vulnerability does not affect the integrity or availability of the system, the confidentiality breach can damage organizational reputation and trust. Since the flaw requires reuse of the same client instance, applications that instantiate a new client per email are less affected. However, many implementations optimize by reusing client instances, increasing the risk. The medium CVSS score reflects the limited attack vector (local or internal code reuse) but significant confidentiality impact. Organizations with high volumes of transactional emails or sensitive communications are particularly at risk.

To mitigate this vulnerability, organizations should immediately upgrade the Lettermint Node.js SDK to version 1.5.1 or later, where the issue is fixed. As a best practice, developers should avoid reusing the same client instance for multiple email sends or ensure that all email properties are explicitly reset before each send operation. Implement rigorous code reviews and testing to verify that no residual data persists between email sends. Additionally, consider implementing application-level logging and monitoring to detect any anomalous email content or recipient patterns that could indicate leakage. For environments where immediate upgrade is not feasible, isolate email sending processes or use separate client instances per email to minimize risk. Finally, review and audit email sending workflows to ensure sensitive data is handled securely and that no unintended data exposure occurs.