Kurrier, a self-hosted workspace for email, calendar, contacts, and storage, had an authorization bypass vulnerability (CWE-639) in its API endpoints prior to version 1.2.4. The affected endpoints did not enforce ownership checks for authenticated API requests when listing or retrieving webhook and identity resources. An attacker with a valid API key could enumerate and read metadata of webhook and identity resources belonging to other accounts by supplying their identifiers. Anonymous requests and invalid API keys were rejected, and modification operations across users were blocked. The issue was resolved in Kurrier version 1.2.4.

An attacker with a valid API key could access metadata of webhook and identity resources belonging to other users, potentially exposing sensitive resource information. However, the vulnerability does not allow unauthorized modification or access without authentication, and anonymous requests are rejected.

Upgrade Kurrier to version 1.2.4 or later, where the authorization checks for ownership on these API endpoints have been properly enforced. No additional mitigation is required as the fix is official and complete.