emailflare before commit cf31f33 Missing Authorization via /api/keys Routes

Summary

emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke existing keys to disable integrations.

Remediation

1. Inventory every 0xdps emailflare deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Patchhttps://github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618f
• Advisoryhttps://www.vulncheck.com/advisories/emailflare-before-commit-cf31f33-missing-authorization-via-api-keys-routes
• Referencehttps://github.com/0xdps/emailflare
• Referencehttps://github.com/0xdps/emailflare/blob/d448ea205937a5e82683f89013d4c23159da5b7d/services/inbox-worker/src/routes/keys.ts