Threats tagged 'ghsa-q8jv-62h2-mqmf'

emailflare versions before commit cf31f33 have a missing authorization vulnerability in the inbox service's /api/keys routes. This flaw allows any authenticated user to list, create, and revoke API keys. Exploitation enables attackers to mint a global live API key accepted by the /v1/send endpoint to send mail from any domain or revoke existing keys to disrupt integrations.