Inbox Zero versions before 2.29.3 have a vulnerability where the cleaner email stream endpoint uses a shared Redis subscription listener. This design flaw allows thread events from one authenticated account to be delivered to another authenticated account concurrently using the cleaner feature, leading to unauthorized exposure of sensitive information. The issue is categorized under CWE-200 (Exposure of Sensitive Information). The vulnerability has a CVSS 4.0 base score of 2.3, indicating low severity. The fix is implemented in version 2.29.3.

The vulnerability allows sensitive email thread events from one authenticated user to be exposed to another authenticated user using the cleaner feature at the same time. This could lead to unauthorized disclosure of email content or metadata between users of the inbox-zero application. There is no indication of remote unauthenticated exploitation or privilege escalation. No known exploits are reported in the wild.

Upgrade inbox-zero to version 2.29.3 or later, where this vulnerability is fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. Patch status is confirmed by the vendor stating the issue is fixed in 2.29.3. No other mitigation steps are indicated.