CVE-2026-44125CWE-862

Missing Authorization in GINAv2

Critical · published May 8, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

SEPPmail Secure Email Gateway before version 15.0.4 fails to enforce authorization checks for multiple endpoints in the new GINA UI, allowing unauthenticated remote attackers to access functionality that should require a valid session.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00530 · 44.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-05-08T13:15Z
EPSS history
Timeline
  • 08 MAY 13:15Z
    Missing Authorization in GINAv2
    cvelistv5