simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d API Gateway Endpoint template.yml SES.sendEmail toEmails/ccEmails/replyToEmails/subject/message missing authentication

Summaryinfo

A vulnerability described as critical has been identified in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d. Impacted is the function SES.sendEmail of the file template.yml of the component API Gateway Endpoint. Such manipulation of the argument toEmails/ccEmails/replyToEmails/subject/message leads to missing authentication. This vulnerability is referenced as CVE-2026-90513. It is possible to launch the attack remotely. No exploit is available. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

Detailsinfo

A vulnerability was found in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d. It has been rated as critical. Affected by this issue is the function SES.sendEmail of the file template.yml of the component API Gateway Endpoint. The manipulation of the argument toEmails/ccEmails/replyToEmails/subject/message with an unknown input leads to a missing authentication vulnerability. Using CWE to declare the problem leads to CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Impacted is integrity, and availability.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-90513. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/12/2026).

The project was informed of the problem early through an issue report but has not responded yet.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• simalexan

Name

• api-lambda-send-email-ses

Version

• bda6869aa81371d1e872242e74fe7d953edb818d

Website

• Product: https://github.com/simalexan/api-lambda-send-email-ses/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #911886: simalexan api-lambda-send-email-ses Git commit bda6869aa81371d1e872242e74fe7d953edb818d and earlier Missing Authentication (by changli)

Once again VulDB remains the best source for vulnerability data.

Discussion