Search

Find a vulnerability

Search criteria

    2 vulnerabilities by kurrier-org

    CVE-2026-50167 (GCVE-0-2026-50167)

    Vulnerability from nvd – Published: 2026-08-18 18:01 – Updated: 2026-08-19 18:21
    VLAI
    Title
    Kurrier: Authenticated cross-user authorization bypass in Kurrier API
    Summary
    Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use another account's identifiers to read and enumerate webhook and identity resources belonging to that account through apps/worker/server/routes/api/kurrier/webhooks/[id].get.ts, apps/worker/server/routes/api/kurrier/webhooks/index.get.ts, apps/worker/server/routes/api/kurrier/identities/[id].get.ts, and apps/worker/server/routes/api/kurrier/identities/index.get.ts. Anonymous requests and invalid API keys were rejected, and cross-user modification operations were blocked, but affected GET and list operations could expose another user's resource metadata. This issue is fixed in version 1.2.4.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-19 18:04 UTC
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7830 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    kurrier-org kurrier Affected: < 1.2.4
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50167",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-19T18:04:09.506721Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-19T18:21:14.068Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kurrier",
          "vendor": "kurrier-org",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use another account\u0027s identifiers to read and enumerate webhook and identity resources belonging to that account through apps/worker/server/routes/api/kurrier/webhooks/[id].get.ts, apps/worker/server/routes/api/kurrier/webhooks/index.get.ts, apps/worker/server/routes/api/kurrier/identities/[id].get.ts, and apps/worker/server/routes/api/kurrier/identities/index.get.ts. Anonymous requests and invalid API keys were rejected, and cross-user modification operations were blocked, but affected GET and list operations could expose another user\u0027s resource metadata. This issue is fixed in version 1.2.4."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T18:01:08.311Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kurrier-org/kurrier/security/advisories/GHSA-f7h3-f5vh-3764",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kurrier-org/kurrier/security/advisories/GHSA-f7h3-f5vh-3764"
        },
        {
          "name": "https://github.com/kurrier-org/kurrier/pull/446",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kurrier-org/kurrier/pull/446"
        },
        {
          "name": "https://github.com/kurrier-org/kurrier/commit/22fad36fb1bc79e3038184ddd485fb235217475c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kurrier-org/kurrier/commit/22fad36fb1bc79e3038184ddd485fb235217475c"
        },
        {
          "name": "https://github.com/kurrier-org/kurrier/releases/tag/v1.2.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kurrier-org/kurrier/releases/tag/v1.2.4"
        }
      ],
      "source": {
        "advisory": "GHSA-f7h3-f5vh-3764",
        "discovery": "UNKNOWN"
      },
      "title": "Kurrier: Authenticated cross-user authorization bypass in Kurrier API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50167",
    "datePublished": "2026-08-18T18:01:08.311Z",
    "dateReserved": "2026-06-03T20:54:20.433Z",
    "dateUpdated": "2026-08-19T18:21:14.068Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-50167 (GCVE-0-2026-50167)

    Vulnerability from cvelistv5 – Published: 2026-08-18 18:01 – Updated: 2026-08-19 18:21
    VLAI
    Title
    Kurrier: Authenticated cross-user authorization bypass in Kurrier API
    Summary
    Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use another account's identifiers to read and enumerate webhook and identity resources belonging to that account through apps/worker/server/routes/api/kurrier/webhooks/[id].get.ts, apps/worker/server/routes/api/kurrier/webhooks/index.get.ts, apps/worker/server/routes/api/kurrier/identities/[id].get.ts, and apps/worker/server/routes/api/kurrier/identities/index.get.ts. Anonymous requests and invalid API keys were rejected, and cross-user modification operations were blocked, but affected GET and list operations could expose another user's resource metadata. This issue is fixed in version 1.2.4.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-19 18:04 UTC
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7830 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    kurrier-org kurrier Affected: < 1.2.4
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50167",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-19T18:04:09.506721Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-19T18:21:14.068Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kurrier",
          "vendor": "kurrier-org",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use another account\u0027s identifiers to read and enumerate webhook and identity resources belonging to that account through apps/worker/server/routes/api/kurrier/webhooks/[id].get.ts, apps/worker/server/routes/api/kurrier/webhooks/index.get.ts, apps/worker/server/routes/api/kurrier/identities/[id].get.ts, and apps/worker/server/routes/api/kurrier/identities/index.get.ts. Anonymous requests and invalid API keys were rejected, and cross-user modification operations were blocked, but affected GET and list operations could expose another user\u0027s resource metadata. This issue is fixed in version 1.2.4."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T18:01:08.311Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kurrier-org/kurrier/security/advisories/GHSA-f7h3-f5vh-3764",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kurrier-org/kurrier/security/advisories/GHSA-f7h3-f5vh-3764"
        },
        {
          "name": "https://github.com/kurrier-org/kurrier/pull/446",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kurrier-org/kurrier/pull/446"
        },
        {
          "name": "https://github.com/kurrier-org/kurrier/commit/22fad36fb1bc79e3038184ddd485fb235217475c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kurrier-org/kurrier/commit/22fad36fb1bc79e3038184ddd485fb235217475c"
        },
        {
          "name": "https://github.com/kurrier-org/kurrier/releases/tag/v1.2.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kurrier-org/kurrier/releases/tag/v1.2.4"
        }
      ],
      "source": {
        "advisory": "GHSA-f7h3-f5vh-3764",
        "discovery": "UNKNOWN"
      },
      "title": "Kurrier: Authenticated cross-user authorization bypass in Kurrier API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50167",
    "datePublished": "2026-08-18T18:01:08.311Z",
    "dateReserved": "2026-06-03T20:54:20.433Z",
    "dateUpdated": "2026-08-19T18:21:14.068Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}