PT-2026-39715 · Unknown · Inbox-Zero

Elie222 · Published 2026-05-11 · Updated 2026-05-21 · CVE-2026-42865

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Inbox Zero versions prior to 2.29.3

Description The cleaner email stream endpoint used a shared Redis subscription listener. This configuration could result in thread events for one authenticated account being delivered to another authenticated account when both were using the cleaner feature simultaneously.

Recommendations Update to version 2.29.3.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-42865

GHSA-F3GP-V7CJ-2569

Affected Products

Inbox-Zero

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42865.json · Exploit
• https://github.com/elie222/inbox-zero/security/advisories/GHSA-f3gp-v7cj-2569 · Vendor Advisory
• https://github.com/elie222/inbox-zero/commit/02341923b5460ce9630c4681a9b6461ba466688a · Patch
• https://osv.dev/vulnerability/CVE-2026-42865 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42865 · Security Note
• https://t.me/cveNotify/164423 · Telegram Post
• https://twitter.com/CVEnew/status/2053932393275465955 · Twitter Post