CVE-2026-114421 Details
Description
SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set a new password, authenticate as that account, and prevent the intended recipient from using it until recovery.
A vulnerability exists in SEPPmail Secure Email Gateway versions prior to 15.1.1, allowing password recovery for unregistered GINA accounts with an empty initial password. The vulnerability arises from inadequate verification of account ownership during the password recovery process. A remote, unauthenticated attacker can exploit this flaw by identifying such accounts, resetting the password, and gaining access to the account, thereby disrupting the intended user's access until the issue is resolved.
Users can update to SEPPmail Secure Email Gateway version 15.1.1 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.seppmail.com/en/20_revision-history.html | [email protected] | BundleRelease NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-640 | Weak Password Recovery Mechanism for Forgotten Password | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SEPPmail Secure Email Gateway | < 15.1.1 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | [email protected] |