The vulnerability is a Missing Authentication for a critical function that allows an attacker to POST to the /api/auth/register/ endpoint on MailerUp instances that are running a version prior to 1.0.1. Because the RegisterView applies the AllowAny permission with no email verification, CAPTCHA or staff approval, an attacker can create a fully functional account without credentials. Once registered, the account can read all email messages kept by the instance, resulting in complete disclosure of stored messages to an unauthenticated actor.

Mailers up deployments of the MailerUp MailerUp service installed with a version lower than 1.0.1. The vulnerability is present in all instances where the public registration endpoint is enabled and no additional authentication controls are in place.

The CVSS score of 8.8 marks it as a high‑severity problem. No EPSS data is available, but the issue is widely exploitable over the network with no authentication. It is not currently listed in the CISA KEV catalog. An attacker can trigger the flaw simply by issuing a POST to the registration endpoint, creating a new account, and then accessing the mail store.