SCBE-AETHERMOORE EUVD-2026-87356

Exploitation requires that the AetherBrowser API server (scripts/aetherbrowser/api_server.py) is running on an affected version (4.0.2 to prior 4.2.1) with its default bind of 0.0.0.0:8100 and CORS allow_origins=["*"], making the POST /api/ops/check-email endpoint reachable from any network host or browser origin with no authentication. Meaningful data disclosure additionally requires that ProtonMail or Gmail IMAP credentials have actually been configured for email_reader.py - against an install with no email account configured, the endpoint executes but returns no email content, which is the primary factor limiting real-world impact.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5 High) is internally consistent with the description: the AetherBrowser API server binds to 0.0.0.0:8100 with CORS allow_origins=["*"] and the POST /api/ops/check-email endpoint has no authentication (CWE-306), so a remote, unauthenticated attacker on the network - or any malicious web page via the wildcard CORS - can reach it directly. Impact is confidentiality-only (C:H, I:N/A:N), matching disclosure of private email metadata/body snippets with no integrity or availability effect. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is 'no public exploit identified at time of analysis' - do not conflate the trivial exploitability with confirmed exploitation. The most important limiting factor absent from the raw score: the endpoint only yields data if ProtonMail/Gmail accounts are actually configured in email_reader.py; against an unconfigured install it returns nothing. Net: technically trivial to exploit but the real-world priority is tempered heavily by the obscurity of the product and the configuration dependency, so this is a genuinely-easy-but-narrow-footprint issue rather than a mass-exploitation threat.

An attacker who can reach the host on TCP 8100 (or who lures a victim's browser to a malicious page that leverages the wildcard CORS) sends an unauthenticated POST to /api/ops/check-email. The server spawns email_reader.py, connects over IMAP to the operator's configured ProtonMail/Gmail account, and returns sender, subject, and body-snippet data in the JSON response, disclosing the operator's private correspondence. No public proof-of-concept was identified, but exploitation requires only a single crafted HTTP request against a default deployment.