Technical impact
SCBE-AETHERMOORE’s AetherBrowser API server exposes a /api/ops/check‑email endpoint that can be called without authentication. By posting to this endpoint a remote attacker can trigger a subprocess that connects to configured ProtonMail or Gmail accounts via IMAP and returns email metadata—including sender, subject, and a body snippet—in the JSON response. This allows an attacker to read sensitive email contents without authorization, resulting in a confidentiality breach of the operator’s email communications.
Affected Systems
The vulnerability exists in SCBE‑AETHERMOORE version 4.0.2 through 4.2.0. The repository indicates that starting in version 4.2.1 the issue has been patched. No other vendors or product variants are mentioned.
Risk and Exploitability
The endpoint is exposed on 0.0.0.0:8100 with CORS configured to allow all origins, meaning it can be accessed from any network or browser. No authentication is required, so the attack vector is trivially remote, either from a local network or from the Internet if the port is reachable. The CVSS score of 7.5 indicates a high severity with significant impact. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the lack of authentication makes exploitation straightforward if the service is exposed.
Github GHSA