EUVD-2026-29169Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionGitHub Advisory
Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis subscription listener, which could deliver thread events for one authenticated account to another authenticated account using the cleaner feature at the same time. This vulnerability is fixed in 2.29.3.
AnalysisAI
Cross-account email event leakage in Inbox Zero prior to 2.29.3 allows authenticated users of the cleaner feature to receive thread events intended for other authenticated accounts via a shared Redis subscription listener. The vulnerability requires both accounts to be actively using the cleaner feature simultaneously and affects only confidentiality of email metadata, with low attack complexity but requiring prior authentication and precise timing.
Technical ContextAI
Inbox Zero is an AI-powered email management application that uses Redis for real-time event streaming. The cleaner feature implements email thread cleanup via a shared Redis pub/sub subscription listener that was not properly isolating user contexts. The underlying issue stems from insufficient access control in the Redis event delivery mechanism (CWE-200: Information Exposure), where a single subscription channel was used to broadcast thread events without validating that only the intended account receives its own events. The vulnerable endpoint (/api/clean/gmail/route.ts and /api/clean/history/route.ts) lacked identity-scoped filtering when consuming Redis messages, allowing one authenticated session's thread metadata (email IDs, cleanup actions, history) to leak to concurrent authenticated sessions.
RemediationAI
Upgrade Inbox Zero to version 2.29.3 or later, which implements assertCleanerApiEnabled() checks and per-account Redis subscription isolation (confirmed by commit 02341923b5460ce9630c4681a9b6461ba466688a). For self-hosted deployments unable to upgrade immediately, disable the cleaner feature by setting NEXT_PUBLIC_CLEANER_ENABLED=false in environment configuration; this prevents access to affected endpoints but removes cleanup functionality. Patch deployment is strongly preferred as it resolves the issue without operational impact. Consult the GitHub security advisory at https://github.com/elie222/inbox-zero/security/advisories/GHSA-f3gp-v7cj-2569 for verification and deployment guidance.
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild i
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.v
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today