CVE-2026-27492

Katalog CVE

CVSS 4.7 · Medium EPSS 0,17%

Kerentanan Exposure of Data Element to Wrong Session pada lettermint. Skor CVSS 3.1 4.7 (Medium) menurut github.com.

Deskripsi (NVD)

Lettermint Node.js SDK is the official Node.js SDK for Lettermint. In versions 1.5.0 and below, email properties (such as to, subject, html, text, and attachments) are not reset between sends when a single client instance is reused across multiple .send() calls. This can cause properties from a previous send to leak into a subsequent one, potentially delivering content or recipient addresses to unintended parties. Applications sending emails to different recipients in sequence — such as transactional flows like password resets or notifications — are affected. This issue has been fixed in version 1.5.1.

Rincian

Terbit di NVD

21 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.7 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-488: Exposure of Data Element to Wrong Session

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 5,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lettermint/lettermint-node/security/advisories/GHSA-49pc-8936-wvfp mitigasi · advisory vendor
• https://github.com/lettermint/lettermint-node/commit/24a17acbc2429c5eb30391f9df3dc0ea7aaf4de1 patch
• https://github.com/lettermint/lettermint-node/blob/main/CHANGELOG.md#151-2026-02-20 release notes