This vulnerability (CWE-90) in SEPPmail Secure Email Gateway prior to version 15.0.3 involves improper neutralization of special elements used in an LDAP query, commonly known as LDAP injection. An attacker can exploit this by submitting a specially crafted email address, which causes the system to incorrectly associate a PGP signature with the attacker instead of the legitimate user. This undermines the integrity of PGP signature verification within the product.

Successful exploitation allows an unauthenticated attacker to claim another user's PGP signature as their own, potentially undermining trust in email authenticity and signature validation within the affected SEPPmail Secure Email Gateway deployments. There is no indication of remote code execution or system compromise beyond signature impersonation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor SEPPmail advisories for updates. Until a fix is available, consider restricting input validation on email addresses or applying compensating controls if feasible.