CVE-2026-57443

Received Received - Intake

Unauthenticated IMAP Email Metadata Exposure in SCBE-AETHERMOORE

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: GitHub, Inc.

Description

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email` endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the `email_reader.py` subprocess, which connects to configured ProtonMail or Gmail accounts via IMAP and returns email metadata (sender, subject, body snippet) in the JSON response. The server binds to `0.0.0.0:8100` by default with CORS set to `allow_origins=["*"]`, making it reachable from any network or browser origin. Version 4.2.1 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-57443

Affected Vendors & Products

Vendor	Product	Version / Range
scbe-aethermoore	aetherbrowser	to 4.2.1 (exc)
scbe-aethermoore	aetherbrowser	4.2.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is in SCBE-AETHERMOORE, a geometric AI governance framework. The AetherBrowser API server in versions 4.0.2 to 4.2.0 exposes an unauthenticated endpoint POST /api/ops/check-email. Attackers can call this endpoint to trigger a subprocess that reads emails from configured ProtonMail or Gmail accounts via IMAP and returns metadata like sender, subject, and body snippets. The server binds to all network interfaces and allows cross-origin requests, making it accessible from anywhere.

Detection Guidance

Check if the AetherBrowser API server is running on port 8100 by using commands like 'netstat -tulnp | grep 8100' or 'ss -tulnp | grep 8100'. Inspect running processes for 'api_server.py' or 'email_reader.py' using 'ps aux | grep -E "api_server.py|email_reader.py"'.

Impact Analysis

An attacker could exploit this to access your email metadata without authentication. This includes reading emails, sender details, subjects, and snippets, potentially exposing sensitive information. Since the server is exposed to all networks and allows any origin, the risk is high if the system is internet-facing.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. Unauthorized email access could lead to data breaches, resulting in legal penalties and reputational damage.

Mitigation Strategies

Upgrade SCBE-AETHERMOORE to version 4.2.1 or later to patch the vulnerability. If upgrading is not possible, restrict network access to port 8100 using firewall rules or disable the AetherBrowser API server if not needed.

Hi! I’m here to help you understand CVE-2026-57443. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70