bbs-go CVE-2026-121452

Exploitation requires the attacker to hold an active man-in-the-middle position on the network path between the bbs-go server and its configured SMTP mail server, and requires that bbs-go is configured to send mail over a TLS/STARTTLS SMTP connection and is actively doing so (e.g. during user password-reset or verification flows). The specific trigger is the sendEmail() routine in internal/services/email_service.go setting tls.Config.InsecureSkipVerify=true, so any presented certificate - including an attacker's - is accepted. Limiting factors: no remote code execution and no direct server access is possible; the attacker gains nothing without network interception capability, so the realistic risk is confined to environments where the SMTP path traverses attacker-reachable network segments. No authentication (PR:N) or user interaction (UI:N) against bbs-go itself is needed once the MITM position exists.

This is a genuine but conditionally-gated risk rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) correctly captures that exploitation requires no privileges or user interaction but does require the attacker to occupy a man-in-the-middle position on the network path between bbs-go and its SMTP server (AC:H) and to satisfy an attack requirement (AT:P) - i.e. the application must actually be sending email over TLS at the moment of interception. The root cause is confirmed by source code: sendEmail() sets InsecureSkipVerify:true, and the vendor patch replaces this with a verifying smtpTLSConfig() that uses the system trust store and checks ServerName. Impact is primarily confidentiality (VC:H - SMTP PLAIN credentials and outgoing password-reset/verification email contents) with limited integrity (VI:L - ability to modify those outgoing emails). No KEV listing and no EPSS score are present in the input, so there is no signal of active or probable exploitation; combined with the MITM precondition this points to a targeted, not widespread/automatable, threat. SSVC-style decision label is 'this_week' (not act_now/emergency), consistent with a real-but-not-critical priority. The CVSS vector and the description are mutually consistent; no contradictions to flag.

An attacker positioned on the network path between a bbs-go deployment and its configured SMTP server (e.g. on a shared LAN, a compromised upstream hop, or via ARP/DNS spoofing) presents any TLS certificate to the SMTP connection. Because InsecureSkipVerify is true, bbs-go accepts the forged certificate and proceeds, letting the attacker capture the SMTP PLAIN authentication credentials and read or tamper with outgoing password-reset and account-verification emails. No public exploit identified at time of analysis, but the flaw is trivially demonstrable given a MITM foothold.