CVE-2026-42865

Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis subscription listener, which could deliver thread events for one authenticated account to another authenticated account using the cleaner feature at the same time. This vulnerability is fixed in 2.29.3.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/elie222/inbox-zero/commit/02341923b5460ce9630c4681a9b6461ba466688a	Patch
https://github.com/elie222/inbox-zero/security/advisories/GHSA-f3gp-v7cj-2569	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:getinboxzero:inbox_zero:*:*:*:*:*:*:*:*

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Inbox Zero es un asistente personal de IA para correo electrónico. Antes de la versión 2.29.3, el endpoint de flujo de correo electrónico del limpiador utilizaba un oyente de suscripción de Redis compartido, que podía entregar eventos de hilo para una cuenta autenticada a otra cuenta autenticada que utilizaba la función de limpiador al mismo tiempo. Esta vulnerabilidad está corregida en la versión 2.29.3.

Information

Published : 2026-05-11 18:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-42865

Mitre link : CVE-2026-42865

CVE.ORG link : CVE-2026-42865

JSON object : View

Products Affected

getinboxzero

inbox_zero

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo

{"id": "CVE-2026-42865", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42865", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T19:25:04.394974Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "elie222", "product": "inbox-zero", "versions": [{"status": "affected", "version": "< 2.29.3"}]}]}], "published": "2026-05-11T18:16:36.683", "references": [{"url": "https://github.com/elie222/inbox-zero/commit/02341923b5460ce9630c4681a9b6461ba466688a", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/elie222/inbox-zero/security/advisories/GHSA-f3gp-v7cj-2569", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis subscription listener, which could deliver thread events for one authenticated account to another authenticated account using the cleaner feature at the same time. This vulnerability is fixed in 2.29.3."}, {"lang": "es", "value": "Inbox Zero es un asistente personal de IA para correo electr\u00f3nico. Antes de la versi\u00f3n 2.29.3, el endpoint de flujo de correo electr\u00f3nico del limpiador utilizaba un oyente de suscripci\u00f3n de Redis compartido, que pod\u00eda entregar eventos de hilo para una cuenta autenticada a otra cuenta autenticada que utilizaba la funci\u00f3n de limpiador al mismo tiempo. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.29.3."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:getinboxzero:inbox_zero:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96735CCB-CCC9-487F-A5F4-EC379B6CC9D5", "versionEndExcluding": "2.29.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}