The vulnerability is a local file inclusion flaw in the /api/v1/report/summary/{type} API of SmarterMail builds before 9560. An authenticated user can manipulate the {type} parameter to read arbitrary .json files from the server. Because these files may contain encrypted passwords and two‑factor authentication secrets, an attacker can combine the LFI with weak encryption algorithms and hard‑coded keys to decrypt and acquire credentials for all users.

SmarterTools Inc.'s SmarterMail application, specifically versions earlier than build 9560. The flaw affects any deployment of SmarterMail that has not been updated to build 9560 or later.

The CVSS score of 8.7 indicates a high severity, focusing on confidentiality impacts. The EPSS score is not disclosed, and there is no indication that the vulnerability has been listed in the CISA KEV catalog. The flaw requires authentication; any legitimate user who can reach the API endpoint can abuse it. Because the payload leaks file contents that contain encrypted secrets, an exploiter could potentially decrypt passwords and 2FA secrets, giving them full user‑level or even administrative access, depending on the system configuration.