Vulnerability Description
punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward(), which silently drops the added Reply-To header intended to route responses through the relay. When a correspondent sends mail to an alias and the operator replies, the mail client can send directly to the correspondent from the private FORWARD_TO inbox address, exposing that address. The disclosure is limited to the operator's own email address and does not expose third-party data or provide code execution or authentication bypass. This issue is fixed in version 1.5.0.
Related Weaknesses (CWE)
References
- https://github.com/PunchIn-App/punchin-email/commit/593685ffc0b8eb3949a4838e7bfe
- https://github.com/PunchIn-App/punchin-email/pull/66
- https://github.com/PunchIn-App/punchin-email/releases/tag/v1.5.0
- https://github.com/PunchIn-App/punchin-email/security/advisories/GHSA-2ph7-69xm-
FAQ
What is CVE-2026-54649?
CVE-2026-54649 is a documented vulnerability. punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward(), ...
How severe is CVE-2026-54649?
CVSS scoring is not yet available for CVE-2026-54649. Check NVD for updates.
Is there a patch for CVE-2026-54649?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.