The vulnerability resides in the cleaner email stream endpoint that relied on a shared Redis subscription listener. When two authenticated users invoked the cleaner simultaneously, thread events from one account could be delivered to the other account’s subscriber. This flaw enabled the unintended disclosure of email thread data from a user to another user, compromising the confidentiality of the information. The weakness is classified as CWE‑200, an information exposure flaw.

The affected product is Inbox Zero by elie222. Versions prior to 2.29.3 are vulnerable; all later releases contain the fix.

With a CVSS score of 2.3 the CVSS framework rates this issue as low severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated to two separate accounts and to invoke the cleaner feature on both simultaneously, making the attack scenario limited to users with access to both accounts. The flaw does not provide remote code execution or denial of service; it merely exposes thread events from one user to another.