The Swoosh Microsoft Graph adapter builds its API request URL by interpolating the sender's email address into the path (/users/{from}/sendMail) without percent‑encoding or validation. An attacker can supply a crafted email address containing URL‑special characters such as '/' , '?' , or '#' to escape the intended path segment and rewrite the request's path and query string. By leveraging the application's Microsoft Graph bearer token, the attacker can redirect the authenticated POST to other Graph endpoints within the token's scopes and control the request query string. This allows unauthorized access to Microsoft Graph resources. The flaw is an unsafe string handling issue (CWE‑116).

Swoosh library versions 1.12.0 through 1.26.2 when used with the Microsoft Graph adapter in any application that accepts user‑controlled from addresses, such as email relays, contact forms, or send‑as features. Applications that hard‑code a trusted sender address are not affected.

The CVSS score of 2.1 indicates low overall severity, and the EPSS score of <1% shows a very low likelihood of exploitation. However, the attack vector requires only that an attacker supply a crafted email address; the application must forward it to the Microsoft Graph adapter. Once triggered, the attacker can issue authenticated Graph API requests to any endpoint within the token's scopes, yet no remote code execution is possible. The vulnerability is not listed in the CISA KEV catalog.