Vulnerability Intelligence Report
Missing Authorization in GINAv2
CVE-2026-44125
SEPPmail Secure Email Gateway before version 15.0.4 fails to enforce authorization checks for multiple endpoints in the new GINA UI, allowing unauthenticated remote attackers to access functionality that should require a valid session.
No Active Exploit Signals
CVSS Base Score
9.3
CRITICAL
EPSS Probability:0.39%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-862 ↗CWE-862: Missing Authorization
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| SEPPmail AG | Secure Email Gateway | 0 < 15.0.4 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.386%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Switzerland National Cyber Security Centre (NCSC) · CERT · Switzerland |
| Reserved | 2026-05-05T12:56:43 |
| Published | 2026-05-08T13:15:07 |
| Last Updated | 2026-05-18T16:15:35 |
Community Chatter & Buzz