Mailpit’s origin middleware incorrectly checks the raw RequestURI for an "/api/" prefix while Go routing uses the percent‑decoded URL path. Because the websocket.Upgrader.CheckOrigin is set to always return true, a malicious site can request an endpoint such as "/%61pi/events", bypass corsOriginAccessControl(), and reach the /api/events WebSocket handler. This allows unauthenticated users to receive live message IDs, Message‑Id values, sender and recipient fields, subjects, tags, and body snippets from a default Mailpit instance. The weakness is a CWE‑177 literal interpretation of policy combined with CWE‑200 information exposure and CWE‑346 path traversal.

Affected systems are the axllent:mailpit product, specifically Mailpit versions 1.29.0 through 1.30.6 (the vulnerability is fixed in 1.30.6). Deployments that do not use the optional --ui-auth-file configuration are directly exposed.

The CVSS score of 6.5 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is a browser‑based web page that submits a WebSocket request with a percent‑encoded path. No authentication or privilege is required to exploit it, but the compromised data may be sensitive for users who rely on Mailpit’s email testing tool.