The vulnerability CVE-2026-29132 affects SEPPmail Secure Email Gateway prior to version 15.0.3. It involves missing authentication controls (CWE-306) that allow an attacker with access to a victim's GINA account to bypass a secondary password verification step. This bypass permits the attacker to read emails that are otherwise protected by the second-password mechanism. The CVSS 4.0 base score is 6.3 (medium severity), with network attack vector, low attack complexity, and no privileges or user interaction required. The vulnerability is published and assigned by NCSC.ch, but no patch or remediation details are provided in the available data.

An attacker with access to a victim's GINA account can bypass the second-password check and gain unauthorized access to protected emails. This compromises the confidentiality of sensitive email content. There is no indication of privilege escalation or impact beyond unauthorized email reading. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor SEPPmail advisories for updates. Until a fix is available, restrict access to GINA accounts and enforce strong account security to reduce the risk of exploitation.