PT-2026-51838 · Mailerup · Mailerup
CVSS v4.0
8.8
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
MailerUp versions prior to 1.0.1
Description
Missing authentication for a critical function in the
RegisterView (apps/accounts/views.py) allows a remote, unauthenticated attacker to self-register an account on instances where registration should be restricted. This occurs because the POST '/api/auth/register/' endpoint uses the AllowAny permission without requiring email verification, CAPTCHA, or administrator approval. An account created through this method can read all email stored by the instance, leading to full disclosure of stored messages.Recommendations
Update to version 1.0.1 or later.
Restrict access to the POST '/api/auth/register/' endpoint to prevent unauthorized self-registration.
Exploit
Fix
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mailerup