high7.5
CVE-2025-27913
Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email message…
Impact
Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Passbolt | Passbolt Api | before 5.0.0 |