CVE-2026-67448

Name of the Vulnerable Software and Affected Versions Mailpit versions 1.29.0 through 1.30.5

Description An issue exists where the origin middleware in server/server.go checks the raw RequestURI for the /api/ prefix, while Go's ServeMux routes using the percent-decoded URL path. Additionally, server/websockets/client.go configures websocket.Upgrader.CheckOrigin to return true. A malicious website can bypass corsOriginAccessControl() by requesting the endpoint /%61pi/events to reach the /api/events WebSocket handler. This allows an unauthenticated attacker to receive live message IDs, Message-Id values, sender and recipient fields, subjects, tags, and body snippets from a default instance after a user visits the malicious site. This does not affect deployments protected by --ui-auth-file.

Recommendations Update to version 1.30.6. Protect deployments using --ui-auth-file to prevent unauthorized access.