bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Service
Affects bbs-go through 4.4.6 when it sends email over SMTP-over-TLS, such as password reset and notification emails. No fixed version is listed.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fix or patch referenced
- Who is exposed
- Not reported
Do first: Apply the patch listed under Evidence.
- Exploitation0/40No signal
- Exposure17/25No login or user action needed, reachable over the network without a login · Data gap: Advisories don't say whether default setups are affected
- Reach?/20Reach: unknown (data gap). No tracked technology or package matched
- Severity8.3/10CVSS 8.3
- No patch0/5No signal
What would change the score
- Would score about 70 if added to CISA KEV
- Would score about 65 if CISA's SSVC rates exploitation active
- Would score about 30 if advisories confirm default setups are exposed
CVE-2026-121452 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.3 (high) and affects bbs-go; a fix or patch is referenced.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 25/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
bbs-go, a forum/bulletin board software, is affected by a flaw in how its email feature verifies secure connections to mail servers. An attacker positioned on the network could impersonate the mail server, steal SMTP login credentials, and read or alter password-reset and verification emails.
Read the original description
bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify outgoing password-reset and verification emails.
What to do
Apply the patch listed under Evidence.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- mlogclub bbs-go
through 4.4.6
Evidence 5
- Patch
- Report
- Repository
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-121452
Is CVE-2026-121452 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The application does not properly validate the TLS certificate on its outbound SMTP-over-TLS connections. A network attacker positioned between the application and its mail server could intercept the connection, recover the SMTP username and password in cleartext, and read, drop, or modify outgoing emails such as password-reset links.Source: github.com
Which versions are affected by CVE-2026-121452?
bbs-go: through 4.4.6.Source: cve.now feed data
Am I affected, and how do I check?
Versions from the start of the bbs-go range through 4.4.6 are listed as affected. The exposed setup is an application that makes outbound SMTP-over-TLS connections, such as for password reset and notification emails. To check, confirm the installed bbs-go version and whether SMTP email is configured to use TLS.Source: github.com
How do I fix CVE-2026-121452?
The advisory data lists no fixed version and no workaround, so no upgrade target can be named from the available facts. Check the project's releases for a version newer than 4.4.6 that addresses this issue.Source: github.com