CVE-2026-29138 MEDIUM

CVE-2026-29138: PGP Decryption Sender LDAP Injection

Vendor Seppmail

Product Secure Email Gateway

Weakness CWE-90 · LDAP injection

Published April 2, 2026

Last update April 2, 2026

View on NVD All CVEs

CVSS base score

6.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

What the vulnerability does

01Description

SEPPmail Secure Email Gateway before version 15.0.3 allows attackers with a specially crafted email address to claim another user's PGP signature as their own.

Key dates

02Disclosure timeline

April 2, 2026 CVE published

April 2, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-29138 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/90.html

Related vulnerabilities

04Related CVE

CVE-2026-45559 Roxy-WI: LDAP injection in /user/ldap/<username> (admin-only) CVE-2026-31828 Parse Server has an LDAP injection via unsanitized user input in DN and group filter construction CVE-2026-39962 LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable CVE-2020-5281 LDAP connector injection in Perun CVE-2026-25560 WeKan < 8.19 LDAP Authentication Filter Injection