SEPPmail Secure Email Gateway prior to version 15.0.4 fails to enforce authorization on several endpoints within its new GINA UI. This missing authorization (CWE-862) enables unauthenticated remote attackers to access sensitive functionality without a valid session. The vulnerability is network exploitable without authentication or user interaction, resulting in high confidentiality, integrity, and availability impacts. The CVSS 4.0 vector reflects these factors with a score of 9.3. No vendor advisory or patch information is currently provided, and the product is not a cloud service, so remediation depends on vendor updates.

An unauthenticated remote attacker can access protected functionality in the SEPPmail Secure Email Gateway, potentially compromising confidentiality, integrity, and availability of the system. This could lead to unauthorized actions or data exposure within the affected endpoints of the GINA UI. The critical CVSS score of 9.3 reflects the severity of this missing authorization vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor SEPPmail AG communications for updates and consider restricting network access to the affected management interfaces until a patch is available.