The vulnerability CVE-2026-29134 affects SEPPmail Secure Email Gateway prior to version 15.0.3. It involves CWE-807, where the product relies on untrusted inputs for security decisions. Specifically, an external user can modify GINA webdomain metadata, enabling them to bypass restrictions that are enforced on a per-domain basis. The CVSS 4.0 base score is 5.3, indicating a medium severity with network attack vector, low complexity, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

An attacker with low privileges can manipulate webdomain metadata to bypass domain-specific restrictions, potentially allowing unauthorized actions or access that should be restricted by domain policies. The impact is rated medium, reflecting limited but meaningful compromise possibilities. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor SEPPmail advisories for updates. Until a fix is available, consider restricting external user access and reviewing domain restriction configurations to minimize exposure.