swoosh has email-derived URL path injection in Microsoft Graph endpoint (CVE-2026-54893)

The vulnerability in Swoosh.Adapters.MsGraph (CVE-2026-54893) arises because the adapter builds the Microsoft Graph API URL by interpolating the sender's email address directly into the path segment /users/{from}/sendMail without percent-encoding or validating the 'from' address. This allows an attacker who can influence the 'from' address to inject URL-special characters such as '/', '?', and '#' into the local part of the email address. These characters can escape the intended path segment and rewrite the request's path and query string. Since the request is sent authenticated with the application's Microsoft Graph bearer token, the attacker can redirect the request to other Graph API endpoints within the token's scopes, effectively causing a constrained server-side request forgery. The vulnerability affects versions >=1.12.0 and <1.26.3 of the Swoosh library. A patch has been released to fix this issue.

An attacker able to control the sender email address can manipulate the Microsoft Graph API request path and query string, redirecting authenticated requests to other Graph endpoints within the application's bearer token scopes. This can lead to unauthorized actions performed by the application on behalf of the attacker within the limits of the token's permissions. Applications that use fixed, trusted sender addresses are not impacted.

A patch is available for this vulnerability. Users should upgrade Swoosh to version 1.26.3 or later where the issue is fixed. Until patched, applications should avoid deriving the sender's email address from untrusted or user-influenced input. Instead, use fixed, trusted sender addresses to prevent injection of URL-special characters into the Microsoft Graph API request path.