CVE-2025-27913

Passbolt / API PUBLISHED

Description (CNA)

Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header.

Affected (CNA)

Vendor / product	Versions
Passbolt / API	affected 0 before 5

CWE

CWE-348

References

https://www.passbolt.com/incidents/host-header-injection

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.