GlobaLeaks whistleblowing software exploits inadequate validation on the /api/support endpoint, allowing attackers to embed arbitrary URLs into support requests that are automatically forwarded to administrators via email. Because the emails are sent to privileged users, an attacker could direct them to malicious sites, creating a phishing vector that may compromise admin credentials or enable further attacks on the system. This issue maps to improper input validation.

The vulnerability affects GlobaLeaks Whistleblowing Software versions prior to 5.0.89, where the support API accepts unchecked URLs in user requests. Only the pre‑5.0.89 releases are vulnerable; version 5.0.89 and later have been patched to enforce proper validation.

The CVSS base score of 1.2 indicates low severity, and the advisory notes that the vulnerability is not listed in CISA's KEV catalog. An attacker could exploit the flaw by submitting a crafted support request containing a malicious link, but success requires the administrator to open the email and click the link. While the probability of exploitation may be low without social engineering, the patch remains recommended to mitigate any potential phishing risk.