The vulnerability CVE-2026-7864 affects SEPPmail AG Secure Email Gateway before version 15.0.4. It involves exposure of sensitive system information (server environment variables) via an unauthenticated endpoint in the new GINA UI. The vulnerability is classified under CWE-497 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS 4.0 base score is 6.9 (medium severity) with attack vector network, low complexity, no privileges or user interaction required, and low impact on confidentiality. No official fix or patch has been documented in the vendor advisory or other sources at this time.

Remote attackers can obtain sensitive server environment variables without authentication, potentially aiding further attacks or information gathering. The impact is limited to information disclosure with low confidentiality impact as per CVSS metrics. There are no indications of privilege escalation, integrity, or availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the GINA UI endpoint if possible and monitor for unauthorized access attempts. Avoid exposing the vulnerable interface to untrusted networks.