EUVD-2026-28826
GHSA-qhw2-rfvc-fvrq
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionNVD
SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authenticated users to read arbitrary .json files on the system. Attackers can exploit this vulnerability combined with weak encryption algorithms and hardcoded keys to decrypt and access stored passwords and 2FA secrets for all users.
AnalysisAI
{type} endpoint. The vulnerability chains with weak encryption and hardcoded keys to decrypt stored passwords and two-factor authentication secrets for all system users, enabling complete account compromise. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
{type} endpoint access; reset credentials for all system users as a precautionary measure; enforce multi-factor authentication on administrative accounts using external authenticators not stored on the SmarterMail server.
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today