Missing Authorization Vulnerability in Emailflare Product by Cloudflare

CVE-2026-121730

What is CVE-2026-121730?

Emailflare, prior to a specific commit, suffers from a serious missing authorization vulnerability in its inbox compose endpoint. This flaw allows authenticated users to send emails from any sender address, leveraging an unchecked 'from' field that is submitted during the email composition process. Attackers can exploit this weakness to impersonate other users or organizational identities, potentially leading to unauthorized communication with external recipients.

References