Mailpit’s Link Check API performs HTTP HEAD requests to all URLs found in an email without validating target hosts or filtering internal/private IP addresses. The API returns the status code and reason phrase for each link, making the vulnerability non‑blind. An unauthenticated remote attacker can therefore probe internal or privileged services, obtain status information, and potentially use the endpoint for further reconnaissance or denial‑of‑service attempts.

The flaw affects axllent Mailpit deployments running any version prior to 1.29.2. In installations that have no SMTP or API authentication enabled, the /api/v1/message/{ID}/link‑check endpoint is fully exposed and can be accessed from any network source.

The vulnerability has a CVSS score of 5.8, indicating moderate severity, and an EPSS score of less than 1 %, reflecting a low probability of exploitation. The feature is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is remote, requires no special conditions, and the endpoint returns useful information, so the practical risk is higher than the low EPSS would otherwise suggest.