Description

A security flaw has been discovered in nasa-gcn gcn.nasa.gov up to b299b562af665878964b981a459f0a9c04b11adf. This issue affects some unknown processing of the file /user/email of the component Email Notification Handler. Performing a manipulation of the argument Recipient results in improper authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The pull request to fix this issue awaits acceptance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-11-06T15:17:20.410Z",
  "pubdate": "2026-11-06T15:17:20.410Z",
  "executiveSummary": "A critical security vulnerability involving improper authorization has been identified in the Email Notification Handler of nasa-gcn (up to commit b299b562af665878964b981a459f0a9c04b11adf).\nThe flaw resides within the processing logic of the /user/email endpoint, specifically pertaining to the manipulation of the Recipient argument.\nThis vulnerability allows remote attackers to bypass existing authorization controls, potentially leading to unauthorized notifications or information disclosure related to the email notification system.\nGiven that an exploit has been released to the public, the risk to operational integrity is elevated.\nThe product utilizes a rolling release strategy, meaning specific version tags are unavailable; therefore, all deployments prior to the application of the pending security patch are considered affected.\nThe ability for remote exploitation without prior authentication or privilege escalation makes this a high-priority concern for systems maintaining continuous delivery.",
  "technicalDetails": "The vulnerability is classified as an improper authorization flaw within the nasa-gcn Email Notification Handler. The root cause lies in the server-side processing of the /user/email file, where the application fails to adequately validate or sanitize the Recipient argument provided by the user during the request lifecycle.\nThe attack flow begins when an unauthenticated or authenticated remote attacker crafts a malicious HTTP request directed at the /user/email endpoint. By manipulating the Recipient parameter, the attacker is able to influence the destination or context of the email notification handler. Because the application logic fails to perform sufficient verification of the requester's permissions relative to the target specified in the Recipient field, the handler proceeds to execute the notification request based on the attacker-supplied input.\nTechnically, the vulnerability suggests a lack of server-side object-level authorization (BOLA/IDOR variant) where the input parameter is used to perform administrative or user-specific actions without verifying that the request originator is authorized to interact with the specified Recipient entity. In the context of a continuous delivery environment, the absence of robust access control checks during parameter binding allows an attacker to inject or substitute values that the underlying notification service subsequently processes as trusted data.\nThe exploit, which is currently publicly available, leverages this lack of authorization to perform actions that should be restricted. Potential post-exploitation impacts include unauthorized email generation, message interception, or the routing of sensitive system notifications to arbitrary external addresses. This effectively allows an attacker to manipulate the communication flow of the platform.\nAs the system operates under a rolling release model, the vulnerable component resides in the codebase up to commit b299b562af665878964b981a459f0a9c04b11adf. The current state requires the acceptance and integration of a pending pull request to remediate the logic error in the notification handler. Until the patch is applied, the endpoint remains susceptible to external exploitation via standard network protocols."
}