Threats affecting pkg:github/emailflare

CVE-2026-121730 is a missing authorization vulnerability in the 0xdps emailflare product before commit cf31f33. It affects the POST /api/inbox/compose endpoint, allowing authenticated users to send emails with arbitrary sender addresses. This flaw enables impersonation of other users or the organization to external recipients. The vulnerability has a high severity with a CVSS score of 7.1 and has been fixed in commit cf31f33bbb4a324d5353b8a5db0312fedc19618f.

CVE-2026-121729 is a missing authorization vulnerability in the emailflare product by 0xdps affecting versions before commit cf31f33. It allows any authenticated user to list, create, and revoke API keys via the inbox service /api/keys routes. Exploitation enables attackers to mint a global live API key accepted by the /v1/send endpoint to send mail from any domain or revoke existing keys to disrupt integrations.