SEPPmail Secure Email Gateway versions prior to 15.0.3 contain a flaw that allows an attacker who can access a victim’s GINA account to bypass a secondary password verification step and read encrypted or protected emails. This missing authentication weakness (CWE‑306) exposes confidential information to an unauthorized party, giving the attacker potential access to sensitive communications. The primary impact is confidentiality loss, as the attacker can view content that should be restricted to authorized users.

Any installation of SEPPmail Secure Email Gateway running a version earlier than 15.0.3 is impacted. Systems that deploy the affected software must be assessed for the presence of this vulnerability.

The CVSS base score of 6.3 indicates moderate severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, suggesting limited evidence of widespread exploitation. Exploitation requires access to a victim's GINA account; once such an account is compromised, the attacker can read protected messages. Because the vulnerability is internal to the gateway logic and requires legitimate credentials, the overall risk remains moderate but serious for environments handling sensitive mail.