The Swoosh Microsoft Graph adapter builds the API request URL by inserting the sender's email address directly into the path (/users/{from}/sendMail) without percent‑encoding or validation. Because email addresses derived from untrusted input can contain special URL characters such as '/' ,? or #, an attacker can manipulate the URL path and query string. This allows redirecting the authenticated POST request to any Graph endpoint within the token's scopes, potentially exposing data or performing privileged actions on behalf of the application. The flaw is an unsafe string handling issue (CWE‑116).

Swoosh library versions 1.12.0 through 1.26.2 when used with the Microsoft Graph adapter in any application that accepts user‑controlled from addresses, such as email relays, contact forms, or send‑as features. Applications that hard‑code a trusted sender address are not affected.

The CVSS score of 2.1 indicates low overall severity, and the EPSS score of <1% shows a very low likelihood of exploitation. However, the attack vector requires only that an attacker supply a crafted email address; the application must forward it to the Microsoft Graph adapter. Once triggered, the attacker can issue authenticated Graph API requests to any endpoint within the token's scopes, yet no remote code execution is possible. The vulnerability is not listed in the CISA KEV catalog.