Password Recovery Vulnerability in SEPPmail Secure Email Gateway
CVE-2026-114421

8.3HIGH

Key Information:

Vendor

Seppmail Ag

Status
Seppmail Secure Email Gateway (seg)
Vendor
CVE Published:
4 November 2026

What is CVE-2026-114421?

The SEPPmail Secure Email Gateway allows an unauthenticated attacker to exploit a flaw in the password recovery mechanism for GINA accounts that have been created but remain unregistered. If the initial password of such an account is left empty, the attacker can reset the password without sufficient verification of ownership. This unauthorized access enables the attacker to take control of the account, preventing the rightful owner from using it. This vulnerability poses significant risks to data integrity and user access management.

Affected Version(s)

SEPPmail Secure Email Gateway (SEG) 0 < 15.1.1

References

https://docs.seppmail.com/en/20_revision-history.html

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Synack, Inc
.