Seppmail CVE-2026-29133

Although CVSS and EPSS scores are not available, the vulnerability presents a meaningful security risk grounded in identity spoofing rather than remote code execution or denial of service. The attack vector is network-based and likely requires low complexity (uploading a specially crafted key), but authentication requirements are not confirmed from provided data. The information disclosure tag and the nature of the flaw-allowing identity impersonation in email communications-suggest this affects confidentiality and authenticity of encrypted email. Real-world impact depends on whether the gateway enforces strict UID validation during message encryption and verification; if administrators have not validated existing keys or if the gateway does not warn on UID mismatches, encrypted messages could be sent to or verified against attacker-controlled keys, enabling man-in-the-middle attacks or impersonation. This is a moderate to significant priority for organizations relying on the gateway for email security, particularly in regulated industries requiring non-repudiation and integrity assurance.

An attacker crafts a PGP key with a UID claiming ownership of 'ceo@company.com' but uploads it to the SEPPmail gateway using their own account. Due to the validation flaw, the gateway stores this key and associates it with 'ceo@company.com' despite the mismatch. When an employee encrypts an email destined for the CEO using the gateway's key lookup, the system retrieves the attacker's key instead of the legitimate CEO's key. The attacker can then decrypt the message using their private key, obtaining sensitive information or enabling further social engineering attacks. No public exploit code has been identified at the time of analysis.