CVE-2026-67448

COMPONENT VERSION RANGE

NewScan fingerprints Mailpit from its response and reports this CVE when the detected version falls inside the affected range below.

6.5. server/server.go's origin middleware decides whether a request is an API call from the RAW RequestURI while the router matches the DECODED path, so the two disagree and a re-spelled /api/ request is treated as non-API - skipping the origin check that is the only thing standing between a cross-site page and every message Mailpit holds. Mailpit's inbox is where password-reset links, invitations and API keys land in a dev/staging environment, hence `high` rather than NVD's 6.5 under docs/severity-standard.md. Range is the vendor advisory GHSA-8r62-w5wh-fc5m, `from 1.29.0 until 1.30.6`. ONE row for the whole 2026-08-21 Mailpit batch: 1.30.6 fixes all four, so four rows would be four findings that all say "upgrade to 1.30.6" (the Bouncy Castle precedent). The other three are named in `cves` and are DoS, each with its own earlier fix - CVE-2026-67445 (internal/smtpd/smtpd.go session.readLine() calls bufio.Reader.ReadString with no cap, fixed 1.30.4), CVE-2026-67446 (image attachments decoded to a full raster before the dimension check, fixed 1.30.4) and CVE-2026-67447 (readData() calls ReadBytes before applying the size limit, fixed 1.30.5) - so on a 1.30.4 or 1.30.5 install this row is still true for CVE-2026-67448 while some of the `cves` set is already patched; the note is the honest reading. The lower bound is deliberately CVE-2026-67448's own `ge 1.29.0` even though the DoS trio has no lower bound, so a pre-1.29 install under-reports rather than being told the headline CVE applies to it (under-reporting beats a wrong claim). Version-match only: the origin bypass is proven by sending a cross-origin request that reads a customer's mail, and the three DoS bugs are proven by exhausting their memory - neither is probeable. Reachable as of today because the new Mailpit tech_signatures row supplies the version from GET /api/v1/info - measured 2026-08-21 against axllent/mailpit:v1.30.3 (this row fires) and :v1.30.7 (it does not), with the MP_UI_AUTH-hardened build answering 401 on every path and so recording nothing.