Executive brief
Swoosh is a library used by Elixir applications to send emails. A vulnerability in its Microsoft Graph integration allows an attacker to manipulate the web address used to send emails if the application allows users to specify the 'from' address (such as in a contact form). This could allow an attacker to redirect authorized requests to other parts of the Microsoft Graph API, potentially performing unauthorized actions using the application's credentials.
Technical details
The vulnerability exists in the `Swoosh.Adapters.MsGraph` module, specifically within the `api_endpoint_url/2` function in `lib/swoosh/adapters/ms_graph.ex`. The library constructs the Microsoft Graph API request URL by directly interpolating the sender's email address into the path `/users/{from}/sendMail` without percent-encoding or validation. If an application derives the 'from' address from untrusted input, an attacker can inject characters like '/', '?', or '#' to rewrite the path and query string. Since the resulting request is sent as an authenticated POST using the application's bearer token, the attacker can reach any Graph endpoint within the token's authorized scope. The issue is fixed in version 1.26.3 by implementing proper URI encoding.
Affected products
- swoosh swoosh >= 1.12.0, < 1.26.3
Timeline
- 2026-07-06: disclosed
- 2026-07-06: patched: Fixed in version 1.26.3
- 2026-07-06: advisory