SEPPmail Secure Email Gateway incorrectly interprets email addresses in message headers, which can lead to an interpretation conflict with other mail infrastructure. This flaw enables an attacker to forge the apparent sender address or to view email content that should remain confidential. The weakness is classified under CWE‑436, indicating an incorrect loop or condition that misprocesses input data.

The vulnerability affects the SEPPmail Secure Email Gateway product from SEPPmail. All installations using a version prior to 15.0.1 are potentially compromised, as the patch that corrects the header parsing logic is included in release 15.0.1 and later.

With a CVSS base score of 7.8 the flaw is rated high severity. The EPSS score is under 1%, suggesting a low but non-zero likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. An attacker would most likely exploit this by crafting a malicious email with specially constructed headers and delivering it to the gateway or to downstream mail infrastructure that interfaces with the gateway. Successful exploitation would allow the attacker to impersonate legitimate senders and/or gain access to email content that should remain confidential.