Threats tagged 'ghsa-7mvm-jcxm-mh2j'

A missing authorization vulnerability exists in emailflare before commit cf31f33 in the POST /api/inbox/compose endpoint. Authenticated users can exploit this flaw to send emails with arbitrary sender addresses, enabling impersonation of other users or the organization to external recipients.