GlobaLeaks’ /api/support endpoint accepts support requests before version 5.0.89 with only minimal validation. As a result, attackers can embed arbitrary URLs into the support email that is sent to administrators, enabling phishing or credential‑stealing attacks. This flaw is an input‑validation weakness, identified as CWE-20, and may compromise the confidentiality or integrity of administrator accounts.

The vulnerability affects all installations of Globaleaks whistleblowing software before version 5.0.89. Any user running an earlier release is vulnerable when using the open /api/support API endpoint, as the product sends support emails containing the unsanitized URLs to system administrators.

The CVSS score of 1.2 denotes low severity, and the EPSS score of less than 1% indicates a very low probability of exploitation. It is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation would most likely require the ability to submit a crafted support request to the vulnerable API, which may be limited to users who have access to the API endpoint. Based on the description, it is inferred that the attack requires ability to submit a support request through the /api/support endpoint. Since the flaw is based on unsanitized user input, the prerequisites are minimal, but the overall risk to most deployments remains low.