SEPPmail Secure Email Gateway versions prior to 15.0.3 contain a vulnerability that permits attackers to inject a specially crafted email address during PGP decryption of messages. This LDAP injection flaw allows the attacker to read the contents of emails that are encrypted for other users. The weakness is categorized as CWE-90, reflecting an improper handling of LDAP queries that can expose confidential information.

All instances of SEPPmail Secure Email Gateway with a version earlier than 15.0.3 are affected. Users running the software should verify their current release against the vendor’s advisory for version 15.0.3 and later, which resolves the issue.

The CVSS base score of 4.9 indicates moderate risk for confidentiality compromise. No EPSS score is reported and the vulnerability is not listed in CISA’s KEV catalog, suggesting it has not been widely exploited yet. The likely attack vector involves sending a crafted email to a target system, exploiting the LDAP injection during decryption to access encrypted messages. If the system processes emails from untrusted sources, the window for successful exploitation remains open.