Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header.
CVE ID: CVE-2025-27913
CVSS Base Severity: LOW
CVSS Base Score: 2.1
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Vendor: Passbolt
Product: API
EPSS Score: 0.02% (probability of being exploited)
EPSS Percentile: 2.73% (scored less or equal to compared to others)
EPSS Date: 2025-04-08 (when was this score calculated)