Serpbear
Monthly
Unauthenticated POST requests to /api/notify in SerpBear earlier than 3.1.1 bypass the application's verifyUser() authentication check and let any remote party trigger the instance's notification-email pipeline, optionally targeting a specific domain parameter. Repeated requests can exhaust SMTP sending quotas, trip email-provider abuse flags, and flood notification recipients; impact is limited to availability and mail abuse, with no data disclosure or modification. Meaningful impact requires the instance to have working SMTP/notification settings configured and the API to be network-reachable; no public exploit code was identified at time of analysis, and the issue is rated moderate priority rather than an emergency, with a vendor fix released in 3.1.1.
Unauthenticated POST requests to /api/notify in SerpBear earlier than 3.1.1 bypass the application's verifyUser() authentication check and let any remote party trigger the instance's notification-email pipeline, optionally targeting a specific domain parameter. Repeated requests can exhaust SMTP sending quotas, trip email-provider abuse flags, and flood notification recipients; impact is limited to availability and mail abuse, with no data disclosure or modification. Meaningful impact requires the instance to have working SMTP/notification settings configured and the API to be network-reachable; no public exploit code was identified at time of analysis, and the issue is rated moderate priority rather than an emergency, with a vendor fix released in 3.1.1.