CVE-2026-54893

Name of the Vulnerable Software and Affected Versions swoosh versions 1.12.0 through 1.26.2

Description URL path injection exists in the Microsoft Graph adapter of Swoosh. The Swoosh.Adapters.MsGraph component constructs the Microsoft Graph API request URL by interpolating the sender's email address into the path /users/{from}/sendMail without validation or percent-encoding. In applications where the from address is derived from untrusted or user-influenced input, an attacker can use URL-special characters such as /, ?, or # in the local part of the address to escape the intended path segment. This allows the attacker to rewrite the request path and query string, redirecting the authenticated POST request to other Graph endpoints within the token's scopes using the application's bearer token.

Recommendations Update to version 1.26.3 or later. Validate or reject sender addresses containing characters outside the allowed RFC 5321 set, specifically /, ?, #, and .., before passing the email to the adapter. Set a static :url in the adapter configuration to bypass the interpolation of the from address into the request path.