SEPPmail Secure Email Gateway versions prior to 15.0.3 contain an input validation flaw that allows an attacker to craft a password-tag that bypasses the gateway’s subject sanitization process. This weakness, identified as CWE‑20 (Improper Input Validation), can enable the injection of unexpected email subject content or malicious payloads, potentially compromising the confidentiality or integrity of messages and leading to unauthorized actions within the mail system.

The vulnerability affects SEPPmail Secure Email Gateway software, with all releases preceding version 15.0.3 being susceptible. Users running any older build of the gateway should consider checking their installation against this advisory.

The CVSS base score of 5.3 indicates moderate severity. Exploit probability data is currently unavailable, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector involves an attacker sending a crafted email that includes the malicious password-tag to the gateway; no additional authentication or privileged access is required beyond the ability to transmit such a message to the mail processor. Given the straightforward nature of the input, the risk to systems using unpatched SEPPmail versions is moderate while the potential impact could be higher if the gateway is used to forward messages broadly or to integrate with other services.