GCVE - cpe:2.3:a:punchin-app:punchin-email:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:punchin-app:punchin-email:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Punchin App (`8fbf8c8f-749e-58bc-b327-1eee2fa27b60`)
Product	Punchin Email (`5c8c62a6-d5dc-583e-bd22-17dd99a44aec`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-54649`	vulnerable	2026-10-13 12:29:13.631952	punchin-email: Operator inbox (FORWARD_TO) disclosed to correspondents on reply — Cloudflare forward() drops the relay Reply-To punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward(), which silently drops the added Reply-To header intended to route responses through the relay. When a correspondent sends mail to an alias and the operator replies, the mail client can send directly to the correspondent from the private FORWARD_TO inbox address, exposing that address. The disclosure is limited to the operator's own email address and does not expose third-party data or provide code execution or authentication bypass. This issue is fixed in version 1.5.0. Published: 2026-09-17T18:29:23.937Z Updated: 2026-09-24T20:55:22.973Z Open on db.gcve.eu Reference links https://github.com/PunchIn-App/punchin-email/security/advisories/GHSA-2ph7-69xm-hmwv https://github.com/PunchIn-App/punchin-email/pull/66 https://github.com/PunchIn-App/punchin-email/commit/593685ffc0b8eb3949a4838e7bfe1e97b953d084 https://github.com/PunchIn-App/punchin-email/releases/tag/v1.5.0	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.