SEPPmail Secure Email Gateway before version 15.0.4 does not enforce authorization checks on several endpoints in the new GINA UI. An unauthenticated attacker can invoke these endpoints and perform actions that should be protected by a valid session, compromising the confidentiality and integrity of the gateway and potentially exposing sensitive mail data. This flaw maps to CWE-862 and is rated a CVSS score of 9.3, indicating high severity.

The vulnerability affects SEPPmail Secure Email Gateway deployments running any version earlier than 15.0.4. No additional product or subsystem information is listed.

The Attack Vector is remote, as the unauthenticated requests are sent over the network to the GINA UI endpoints. An attacker needs only network access to the gateway and does not require valid credentials. The lack of authentication checks allows the exploitation of privileged functions via simple HTTP requests. EPSS data is not available, but the CVSS score of 9.3 suggests that exploitation is likely if the gateway is exposed. The vulnerability is not yet listed in the CISA KEV catalog.