This vulnerability, identified as CWE-90 (LDAP Injection), affects SEPPmail Secure Email Gateway prior to version 15.0.3. It arises from improper sanitization of input used in LDAP queries, enabling an attacker with a specially crafted email address to bypass access controls and read encrypted emails intended for other users. The CVSS 4.9 score reflects network attack vector with low complexity and partial privileges required. No patch or vendor advisory details are currently available to confirm remediation status.

An attacker with low privileges and no user interaction can exploit this vulnerability remotely to access the contents of emails encrypted for other users. This compromises the confidentiality of sensitive email communications within the affected SEPPmail Secure Email Gateway deployments. There is no indication of integrity or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the SEPPmail Secure Email Gateway management interfaces and monitor for suspicious input patterns related to email addresses. Avoid using vulnerable versions in production environments if possible.