CVE-2026-115770

Name of the Vulnerable Software and Affected Versions Pocket ID versions 2.2.0 through 2.11.0

Description An issue exists where the SendEmailVerification function uses a token model that binds an email-verification token only to the user identifier. Because the UpdateUser function allows changing the account email without invalidating existing tokens, and VerifyEmail marks the current address as verified, a user can request a token for an address they control, change the account to an arbitrary unused address, and then redeem the original token. This results in the new address being marked as verified. This occurs when the configuration has emailsVerified set to false and allowOwnAccountEdit set to true, provided the target address is not already associated with another user. Relying applications that use verified emails for automatic account matching or provisioning may allow an attacker to link their identity to another user's account.

Recommendations Update to version 2.12.0.