SEPPmail Secure Email Gateway versions prior to 15.0.3 contain a flaw that allows an attacker to abuse the GINA account initialization process to reset a victim’s password, thereby gaining control of that account. This vulnerability leads to an account takeover threat that can compromise user confidentiality, integrity, and availability, and is categorized as CWE‑288.

The affected product is SEPPmail Secure Email Gateway. All installations running a version earlier than 15.0.3 are vulnerable; version 15.0.3 and later are not impacted.

The CVSS score of 7.8 indicates a high risk of exploitation. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, so public exploit evidence is currently lacking. The likely attack path involves an attacker gaining sufficient privileges to trigger the GINA account initialization routine; this may require authenticated or local access, but the exact vector is not fully specified in the advisory. Administrators should treat the issue as high risk and consider it a priority for remediation.