CVE-2026-67448

Summary

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures websocket.Upgrader.CheckOrigin to return true. A malicious website can request /%61pi/events, skip corsOriginAccessControl(), reach the /api/events WebSocket handler, and receive live message IDs, Message-Id values, sender and recipient fields, subjects, tags, and body snippets from an unauthenticated default Mailpit instance after the user visits the site. This is a regression of the earlier WebSocket origin protection and does not affect deployments protected by –ui-auth-file. This issue is fixed in version 1.30.6.

Affected Software

VendorProductVersion RangeStatus
axllentmailpit>= 1.29.0, < 1.30.6affected

Weaknesses

  • CWE-177: CWE-177: Improper Handling of URL Encoding (Hex Encoding)
  • CWE-200: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-346: CWE-346: Origin Validation Error

References