Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Assure (cloud-based multi-tenant SMTP relay)",
          "vendor": "N Able",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alessandro Bertoldi BCS via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Update to the advisory posted on 15 June 2026:\nhttps://seclists.org/fulldisclosure/2026/Jun/10\n\nCVE ID: CVE-2025-68624\nGCVE ID: GCVE-128-2026-0001\nProduct: N-able Mail Assure (cloud-based multi-tenant SMTP relay)\nStatus: DISPUTED in the CVE record; fix declared by the vendor on 10 November 2026, not independently verified\n\n\nSummary\n-------\n\nN-able has stated, through its distributor, that it has developed a change to Mail Assure that validates the MAIL FROM \ndomain against the account submitting the message and rejects attempts to send using a domain belonging to another Mail \nAssure customer. On 10 November 2026 N-able stated that \"the enforcement is now active for all Mail Assure customers\", \nwith no action required by customers.\n\nN-able also stated that the change was communicated to Mail Assure customers in a notice sent in September 2026, and \nthat no separate security advisory or release note is planned. The Mail Assure documentation now states that the \n\"Enforce Sender Domain\" setting is mandatory on all accounts.\n\nThis fix is declared by the vendor and has not been independently verified by the reporters.\n\n\nTimeline since the original post\n--------------------------------\n\n- 31 August 2026: GCVE-128-2026-0001 published by bcsec (GCVE Numbering Authority 128).\n- 14 September 2026: CVE-2025-68624 published by MITRE with the DISPUTED and exclusively-hosted-service tags.\n- 27 October 2026: status request sent to N-able PSIRT; only an automatic reply was received. The request was then \npursued through the N-able distributor.\n- 6 November 2026: N-able stated that it has developed a change validating the MAIL FROM domain against the submitting \naccount, to be enabled from November 2026.\n- 10 November 2026: N-able stated that the enforcement is active for all Mail Assure customers.\n\n\nReferences\n----------\n\n- Advisory and full timeline: https://bcsec.io/advisories.php#gcve-128-2026-0001\n- GCVE record: https://db.gcve.eu/vuln/GCVE-128-2026-0001\n- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-68624\n- Mail Assure documentation (Enforce Sender Domain): \nhttps://documentation.n-able.com/mail-assure/userguide/Content/C_Domain%20Level/domains/configuration.htm\n\n\nAlessandro Bertoldi\nBertoldi Cybersecurity\nhttps://bcsec.io\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T01:41:18Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Nov/13"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Nov/13"
        },
        {
          "url": "https://bcsec.io"
        },
        {
          "url": "https://bcsec.io/advisories.php#gcve-128-2026-0001"
        },
        {
          "url": "https://db.gcve.eu/vuln/GCVE-128-2026-0001"
        },
        {
          "url": "https://documentation.n-able.com/mail-assure/userguide/Content/C_Domain%20Level/domains/configuration.htm"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/2026/Jun/10"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-68624"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Nov/13"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Update: CVE-2025-68624 (N-able Mail Assure cross-tenant spoofing): fix declared by the vendor",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-68624",
              "type": "related"
            },
            {
              "destId": "GCVE-128-2026-0001",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0554",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Nov/13",
            "automated": true,
            "contentSha256": "35f44aa5477862fa631bf889ac297f1734a99f702567eed82fffb2497cc1973b",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Nov/13",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-11-10T11:39:36Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0554"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-11-13T01:41:18Z",
    "dateUpdated": "2026-11-13T01:41:18Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0554"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}