Executive brief
Kodbox is a file management and collaboration platform that includes email notification features. A vulnerability in the msgWarning plugin allows unauthenticated attackers to read and modify SMTP email server configurations, potentially exposing email credentials and enabling mail redirection for phishing, account takeover, and disruption of system notifications.
Technical details
This is an authorization bypass vulnerability (CWE-862: Missing Authorization) in the msgWarning plugin's configuration APIs accessible via /index.php?plugin/msgWarning/action. The plugin's getConfig and setConfig actions do not enforce authentication or administrator authorization, despite the global plugin route excluding login checks. An unauthenticated attacker can send GET requests to read SMTP credentials (host, email, password) or POST requests to modify them. No authentication or user interaction is required; the attack is remotely exploitable via network HTTP requests. Exploitation enables credential theft, SMTP server hijacking, and disruption of critical email-dependent functionality like password resets and notifications.
Affected products
- kalcaddle kodbox 1.67 Build 02
Timeline
- 2026-06-15: disclosed: Vulnerability reported via GitHub
- 2026-08-04: advisory: Published on NVD