Seppmail EUVD-2026-18148

Although CVSS and EPSS scores are unavailable, the risk profile is substantial based on available signals: (1) CWE-807 indicates a fundamental authorization flaw in security decision logic; (2) unauthenticated external access is confirmed from the description and GINA context; (3) the attack requires low complexity (direct metadata modification); (4) the impact directly undermines the product's core security function-per-domain isolation and policy enforcement. NCSC.ch reporting by the Swiss national cybersecurity center elevates credibility. The authentication bypass nature means automation is likely feasible. The absence of CVSS/EPSS does not diminish risk; rather, the ability for external actors to bypass domain restrictions in an email security gateway poses critical business continuity and data protection risks. This should be treated as a priority remediation item for all deployed instances.

An external attacker without authentication credentials sends a crafted request to SEPPmail's GINA webdomain metadata API (low complexity, network-accessible endpoint). The request modifies metadata associated with a target domain, such as disabling encryption policies, relaxing content filtering, or modifying recipient restrictions. Because authorization checks are absent (CWE-807), the modification succeeds, allowing the attacker to bypass per-domain security controls. Subsequent emails routed through that domain are no longer subject to the intended restrictions, enabling phishing, malware, or data exfiltration. No public exploit code availability has been confirmed in the available intelligence.