The SEPPmail Secure Email Gateway contains an LDAP injection flaw that lets an attacker create a specially crafted email address. When the gateway processes this address it associates the attacker's PGP signature with it, making the message appear to be signed by another user. This undermines message authenticity and can be used for phishing or other social engineering attacks.

All releases of SEPPmail Secure Email Gateway older than version 15.0.3 are vulnerable. The flaw resides in the component that validates and stores email addresses.

The CVSS base score of 6.3 indicates moderate severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. The likely attack vector is remote, requiring the ability to send or inject a malicious email address into the gateway’s processing pipeline. Successful exploitation allows an attacker to impersonate another user’s signed messages without needing direct system access.