Missing Authorization in Emailflare Inbox Service by 0xdps

CVE-2026-121729

What is CVE-2026-121729?

The Emailflare inbox service has a significant vulnerability that allows authenticated users to access /api/keys routes without proper authorization. This security flaw enables users to list, create, and revoke API keys. Malicious actors can exploit this vulnerability to generate a global live API key capable of sending emails from any domain or revoke existing keys, thus disabling critical integrations. Immediate measures should be taken to patch this vulnerability to mitigate its potential impact.

References