Submit #1033135: GitHub https://github.com/nasa-gcn/gcn.nasa.gov 4.7.10 Insufficient Verification of Data Authenticity

Description

Summary:
The Email Notifications feature at /user/email lets a signed-in user set any syntactically valid email address as the recipient for a Notice subscription. This is documented as intentional behavior, since GCN’s docs state the recipient defaults to your sign-in address but can be changed. The gap is that there’s no verification step for that recipient address before the subscription activates and starts delivering mail.

Impact:

Any authenticated user can enrol an arbitrary third-party inbox into recurring GCN Notice emails with zero consent.
The recipient has no way to know who subscribed them or why, since the emails identify GCN as the sender, not the account that set it up.

This creates unsolicited, recurring email from a legitimate nasa.gov-affiliated sender, which a recipient could mistake for spam or a phishing precursor, creating reputational risk for GCN.

Steps to Reproduce:

1.Create an account using Email A.
2.Sign in and go to https://gcn.nasa.gov/user/email
3.Click “Add” to create a new Notice subscription.

In the Recipient field, enter Email B, a second address you own, different from the account’s own email.
Select any Notice types and save. No confirmation email goes to Email B before the subscription activates.
Email B immediately starts receiving live GCN Notices with no prior consent.

Suggested Fix:

Either add a double opt-in (store the subscription pending, email the recipient a confirmation link, activate only after they click it), or restrict the recipient field to the account’s own email and build multi-recipient support around the opt-in flow instead.

• Source: ⚠️ https://github.com/nasa-gcn/gcn.nasa.gov/issues/3805
• User: NirvanaOn (UID 102126)
• Submission: 10/14/2026 10:37 (23 days ago)
• Moderation: 11/06/2026 10:19 (23 days later)
• Status: Accepted
• VulDB entry: 431788 [nasa-gcn gcn.nasa.gov up to b299b562af665878964b981a459f0a9c04b11adf Email Notification /user/email Recipient improper authorization]
• Points: 20