CVE-2026-44125: SEPPmail Secure Email Gateway Missing Authorization in GINA UI
SEPPmail Secure Email Gateway versions before 15.0.4 contain a missing authorization weakness (CWE-862) across several endpoints of the new GINA UI. The CNA rates the issue critical with a CVSS 4.0 score of 9.3, and the record describes unauthenticated remote access to functions that should require a valid session. No CISA KEV listing appears in the consulted data.
Overview
SEPPmail Secure Email Gateway versions before 15.0.4 contain a missing authorization weakness (CWE-862) in several endpoints of the new GINA UI. According to the record, these endpoints do not verify a valid session before providing functionality. A research post from InfoGuard Labs covers other SEPPmail vulnerabilities; its title lists different CVE identifiers, so it should not be read as describing this CVE's details.
Impact
- The CNA scored the issue 9.3 (critical) under CVSS 4.0, with network attack vector, low complexity, no privileges required and no user interaction.
- The vector reports high impact on confidentiality, integrity and availability of the vulnerable system.
- Successful exploitation would allow an unauthenticated remote party to reach functions intended only for authenticated users.
Affected products and versions
- Product: SEPPmail Secure Email Gateway, versions before 15.0.4, as stated in the description.
- The record does not contain structured affected version ranges, the list of vulnerable GINA endpoints, or fixed-version data.
Exploitation status
CISA KEV does not list this CVE. No confirmed exploitation in the wild appears in the sources consulted for this analysis. The EPSS record shows a probability of 0.0053 and a percentile of 0.43251, as recorded.
Remediation and mitigation
- Review the SEPPmail 15.0 release notes and plan an upgrade to version 15.0.4 or later.
- Until the upgrade is applied, limit network access to the gateway's web interfaces to trusted administrative networks.
- Where operationally feasible, place the GINA interface behind additional access controls, such as a separate authenticated reverse proxy or network segmentation.
Detection guidance
- Review web access logs for requests to GINA interface paths that succeed without an authenticated session, especially from unfamiliar addresses.
- Monitor for unexpected configuration changes, new accounts or new administrative artifacts on the gateway.
- Correlate gateway logs with authentication events to identify sessionless access to functions that normally require login.
Limitations of the available information
The record does not identify which GINA endpoints are affected, does not provide structured version ranges, and contains no vendor-supplied CVSS score beyond the CNA's score. The 15.0.4 boundary is taken from the description. The release notes were not verified in detail for this analysis, so the exact fix content and any workarounds remain unknown.
Frequently asked questions
What is the vulnerability in CVE-2026-44125?
The CNA reports missing authorization checks on multiple endpoints of the new GINA UI in SEPPmail Secure Email Gateway before 15.0.4. The record says unauthenticated remote attackers can reach functions that should require a valid session.
How severe is it?
The CNA scored it 9.3 under CVSS 4.0, which is rated critical, with network attack vector and no privileges or user interaction required.
Is this CVE known to be exploited?
CISA KEV does not list it, and no confirmed exploitation in the wild appears in the sources consulted for this analysis.
What should administrators do now?
Review the vendor release notes, plan an upgrade to 15.0.4 or later, and restrict network access to the gateway's web interfaces until the upgrade is applied.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.