Kurrier, a self‑hosted workspace for email, calendar, contacts, and storage, suffered an authenticated cross‑user authorization bypass. The flaw allowed an attacker with a valid API key to read and enumerate webhook and identity resources of other accounts by providing their identifiers. This enabled disclosure of sensitive metadata without modifying resources, leading to a confidentiality breach of user data. The weakness is classified as CWE‑639, Cross‑User Information Disclosure via Authorization bypass.

The affected product is Kurrier. Versions prior to 1.2.4 lacked the ownership checks on the API endpoints that list and retrieve webhook and identity resources. The security fix was introduced in release v1.2.4.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation is uncertain, but the vulnerability is not listed in the CISA KEV catalog. An attacker only needs legitimate authentication and access to the API key to exploit the flaw, making it an in‑service API attack. Given the lack of a mitigation in earlier releases, any valid API key holder could potentially read another user's resource metadata, posing a moderate risk of confidentiality compromise.