This vulnerability in simalexan's api-lambda-send-email-ses component up to commit bda6869aa81371d1e872242e74fe7d953edb818d affects the SES.sendEmail function in template.yml of the API Gateway Endpoint. Manipulating the toEmails, ccEmails, replyToEmails, subject, or message arguments leads to missing authentication, enabling remote attackers to exploit the flaw. Due to the rolling release nature of the product, no explicit versioning information is available. The vendor has been notified but has not issued a response or patch yet. The CVSS 4.0 score is 6.9 (medium severity), indicating network attack vector with no privileges or user interaction required.

The vulnerability allows remote attackers to bypass authentication controls in the email sending function, potentially enabling unauthorized email sending via the API Gateway Endpoint. This could lead to misuse of the email service, such as spam or phishing, but no further impact details are provided. No known exploits are reported in the wild.

The vendor has been informed but has not yet responded or issued a patch. Since this is a cloud-hosted service, the vendor typically manages remediation server-side. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the API Gateway Endpoint if possible and monitor for suspicious activity related to email sending.