CVE-2026-114420: LDAP wildcard injection exposes GINA recipient accounts

Analysis on rafaelpfister.ch

Article · November 3, 2026 SEPPmail 15.1.1: Five CVE Fixes and a Fix for the DNS Regression from 15.1.0.1 SEPPmail 15.1.1 closes five vulnerabilities with CVSS scores of up to 9.2, including code execution through address replacement rules and file access through Large File Transfer. The patch release also fixes a DNS regression from 15.1.0.1 and should be installed promptly.

Vendor description

SEPPmail Secure Email Gateway before 15.1.1 does not neutralize LDAP metacharacters in an unauthenticated account-selection input in its GINA web interface. A remote unauthenticated attacker can enumerate email addresses.

Reference data

Vendor

SEPPmail AG

Affected products

SEPPmail Secure Email Gateway (SEG)

CVSS 4.0

6.9 (MEDIUM)

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Weakness type

CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Published

November 4, 2026

Official sources

← All vulnerabilities

CVE-2026-114420 LDAP wildcard injection exposes GINA recipient accounts

Analysis on rafaelpfister.ch

Vendor description

Reference data

Official sources

Subscribe