The vulnerability lies in the SEPPmail Secure Email Gateway’s GINA webdomain metadata handling. An external user can modify this metadata, thereby circumventing restrictions that were meant to apply to specific email domains. This flaw could allow an attacker to gain unintended access to resources or data that are normally confined to a particular domain, compromising confidentiality and integrity. It is categorized as CWE‑807, reflecting a flaw that allows forced reconfiguration of system settings.

SEPPmail Secure Email Gateway versions earlier than 15.0.3 are affected. Users running any pre‑15.0.3 build of the product are vulnerable; versions 15.0.3 and later include the fix.

The CVSS base score of 5.3 indicates moderate severity. Because the exploit requires an external user to alter GINA webdomain metadata, the attacker must reach the web interface, so the vector is likely remote. No EPSS score is available, and the CVE is not listed in the CISA KEV catalog, suggesting that known exploitation is limited or not widespread. Nevertheless, the flaw permits unauthorized domain authority escalation, a concern that warrants prompt remediation.