CVE-2026-42865

Katalog CVE

CVSS 4.3 · Medium EPSS 0,31%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada getinboxzero inbox zero. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis subscription listener, which could deliver thread events for one authenticated account to another authenticated account using the cleaner feature at the same time. This vulnerability is fixed in 2.29.3.

Rincian

Terbit di NVD

11 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/elie222/inbox-zero/security/advisories/GHSA-f3gp-v7cj-2569 patch · advisory vendor
• https://github.com/elie222/inbox-zero/commit/02341923b5460ce9630c4681a9b6461ba466688a patch