Critical · published January 8, 2026
🔥 Authenticated attackers can exploit this vulnerability with just a crafted input to send any SMTP command they desire! Think of this like a sneaky waiter who, armed with your consent to place an order, decides to change your meal to something entirely different without you knowing — a recipe for disaster! If exploited, attackers could hijack the email-sending function of the application, sending malicious emails or unauthorized messages, potentially leading to phishing attacks or data leaks. This could devastate your organization’s reputation and security. ⚡
Think of this like a sneaky waiter who, armed with your consent to place an order, decides to change your meal to something entirely different without you knowing — a recipe for disaster! This vulnerability in the AppConnector component of enaio allows authenticated remote attackers to inject arbitrary SMTP commands via input to the /osrest/api/organization/sendmail endpoint, bypassing normal email controls.
If exploited, attackers could hijack the email-sending function of the application, sending malicious emails or unauthorized messages, potentially leading to phishing attacks or data leaks. This could devastate your organization’s reputation and security. ⚡ Immediate action is necessary: upgrade to the latest versions of enaio — 10.10.0.184, 11.0.0.184, or 11.10.0.184. Additionally, review your configurations to limit access to the sendmail endpoint and monitor for any suspicious email activity. 🛡️ You've got this! Patch and protect your systems now to keep the bad guys at bay! 🚀