CVE-2026-9592 PUBLISHED

Sensitive Information Disclosure in HTTP header

Assigner: NCSC.ch
Reserved: 26.05.2026 Published: 17.07.2026 Updated: 17.07.2026

SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token is disclosed inside the URL and a HTTP header.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U
CVSS Score: 7.5

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Adjacent	Confidentiality	High	Confidentiality	High
Attack Complexity	Low	Integrity	High	Integrity	High
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	SEPPmail
Product	SEPPmail Secure Email Gateway & SEPPmail Cloud
Versions	Default: unaffected Version 15.0.4.2 is unaffected

Credits

Aleksandar Marčeta-Pavlović from WKO Inhouse GmbH of the Austrian Economic Chambers finder

References

https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#remove-login-redirect-to-prevent-disclosure-of-session-token-information

Problem Types

CWE-598 Use of GET request method with sensitive query strings CWE

Impacts

CAPEC-593 Session Hijacking