Search
Find a vulnerability
Search criteria
2 vulnerabilities found for inbox_zero by getinboxzero
CVE-2026-42865 (GCVE-0-2026-42865)
Vulnerability from nvd – Published: 2026-05-11 17:53 – Updated: 2026-05-11 19:25
VLAI
EPSS
VEX
Title
Inbox Zero: Cross-account cleaner email stream exposure
Summary
Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis subscription listener, which could deliver thread events for one authenticated account to another authenticated account using the cleaner feature at the same time. This vulnerability is fixed in 2.29.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-11 19:25 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/elie222/inbox-zero/security/ad… | x_refsource_CONFIRM |
| https://github.com/elie222/inbox-zero/commit/0234… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| elie222 | inbox-zero |
Affected:
< 2.29.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42865",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-11T19:25:04.394974Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T19:25:16.428Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "inbox-zero",
"vendor": "elie222",
"versions": [
{
"status": "affected",
"version": "\u003c 2.29.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis subscription listener, which could deliver thread events for one authenticated account to another authenticated account using the cleaner feature at the same time. This vulnerability is fixed in 2.29.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T17:53:08.330Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/elie222/inbox-zero/security/advisories/GHSA-f3gp-v7cj-2569",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/elie222/inbox-zero/security/advisories/GHSA-f3gp-v7cj-2569"
},
{
"name": "https://github.com/elie222/inbox-zero/commit/02341923b5460ce9630c4681a9b6461ba466688a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/elie222/inbox-zero/commit/02341923b5460ce9630c4681a9b6461ba466688a"
}
],
"source": {
"advisory": "GHSA-f3gp-v7cj-2569",
"discovery": "UNKNOWN"
},
"title": "Inbox Zero: Cross-account cleaner email stream exposure"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42865",
"datePublished": "2026-05-11T17:53:08.330Z",
"dateReserved": "2026-04-30T16:44:48.380Z",
"dateUpdated": "2026-05-11T19:25:16.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42865 (GCVE-0-2026-42865)
Vulnerability from cvelistv5 – Published: 2026-05-11 17:53 – Updated: 2026-05-11 19:25
VLAI
EPSS
VEX
Title
Inbox Zero: Cross-account cleaner email stream exposure
Summary
Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis subscription listener, which could deliver thread events for one authenticated account to another authenticated account using the cleaner feature at the same time. This vulnerability is fixed in 2.29.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-11 19:25 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/elie222/inbox-zero/security/ad… | x_refsource_CONFIRM |
| https://github.com/elie222/inbox-zero/commit/0234… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| elie222 | inbox-zero |
Affected:
< 2.29.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42865",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-11T19:25:04.394974Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T19:25:16.428Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "inbox-zero",
"vendor": "elie222",
"versions": [
{
"status": "affected",
"version": "\u003c 2.29.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis subscription listener, which could deliver thread events for one authenticated account to another authenticated account using the cleaner feature at the same time. This vulnerability is fixed in 2.29.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T17:53:08.330Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/elie222/inbox-zero/security/advisories/GHSA-f3gp-v7cj-2569",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/elie222/inbox-zero/security/advisories/GHSA-f3gp-v7cj-2569"
},
{
"name": "https://github.com/elie222/inbox-zero/commit/02341923b5460ce9630c4681a9b6461ba466688a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/elie222/inbox-zero/commit/02341923b5460ce9630c4681a9b6461ba466688a"
}
],
"source": {
"advisory": "GHSA-f3gp-v7cj-2569",
"discovery": "UNKNOWN"
},
"title": "Inbox Zero: Cross-account cleaner email stream exposure"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42865",
"datePublished": "2026-05-11T17:53:08.330Z",
"dateReserved": "2026-04-30T16:44:48.380Z",
"dateUpdated": "2026-05-11T19:25:16.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}