CVE-2026-50167
Received Received - Intake

Authentication Bypass in Kurrier Workspace API

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use another account's identifiers to read and enumerate webhook and identity resources belonging to that account through apps/worker/server/routes/api/kurrier/webhooks/[id].get.ts, apps/worker/server/routes/api/kurrier/webhooks/index.get.ts, apps/worker/server/routes/api/kurrier/identities/[id].get.ts, and apps/worker/server/routes/api/kurrier/identities/index.get.ts. Anonymous requests and invalid API keys were rejected, and cross-user modification operations were blocked, but affected GET and list operations could expose another user's resource metadata. This issue is fixed in version 1.2.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-50167
EUVD
EUVD-2026-61098

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kurrier kurrier to 1.2.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Kurrier is a self-hosted workspace for email and related services. Prior to version 1.2.4, its API endpoints for listing and retrieving webhook and identity resources lacked ownership checks. An attacker with a valid API key could access another user's resource metadata by exploiting these endpoints, even though they couldn't modify the resources.

Detection Guidance

To detect this vulnerability, check if your Kurrier instance is running a version prior to 1.2.4. Use commands like 'curl -s https://your-kurrier-instance.com/api/version' or inspect package.json for version details. Monitor API logs for unauthorized access attempts to webhook or identity endpoints.

Impact Analysis

If you use Kurrier before version 1.2.4, an attacker with your API key could view your webhook and identity resource metadata, potentially exposing sensitive information about your setup or usage patterns. This could lead to further targeted attacks or privacy breaches.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR and HIPAA by exposing personal or sensitive metadata without authorization. Unauthorized access to identity and webhook resources may constitute a breach of confidentiality requirements under these standards.

Mitigation Strategies

Immediately upgrade Kurrier to version 1.2.4 or later. Restrict API access to trusted users only. Review logs for suspicious activity related to webhook or identity endpoints. Apply network-level restrictions if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50167. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart