CVE-2026-50167

Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use anothe...

CVE-2026-50167 Kurrier: Authenticated cross-user authorization bypass in Kurrier API

Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use anothe...

CVE-2026-50167

In Kurrier versions prior to 1.2.4, GET and list endpoints for webhooks and identities lacked cross-account ownership enforcement, allowing any authenticated user with a valid API key to enumerate and read another account's resource metadata. The flaw is fixed in version 1.2.4. No exploitation ev...

CVE-2026-50167 Kurrier: Authenticated cross-user authorization bypass in Kurrier API

Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use anothe...