{"items":[{"id":"NVI-00012178","kind":"vulnerability","title":"swoosh has email-derived URL path injection in Microsoft Graph endpoint","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-754j-98wh-57rf","CVE-2026-54893"],"plain_summary":"GitHub lists this reviewed advisory for swoosh. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-bda8618f8999105106b4ebbb9905e2c1"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-bda8618f8999105106b4ebbb9905e2c1","url":"https://github.com/advisories/GHSA-754j-98wh-57rf","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-754j-98wh-57rf","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:14:14.588Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-bda8618f8999105106b4ebbb9905e2c1"],"technology":"swoosh","known_exclusions":[],"conditions_summary":"### Summary\n\n`Swoosh.Adapters.MsGraph` builds its Microsoft Graph API request URL by interpolating the sender's email address directly into the URL path (`/users/{from}/sendMail`) without percent-encoding or validation. In applications that derive the `from` address from untrusted or user-influenced input (a relay, a contact form, or a \"send as\" feature), an attacker can inject URL-special characters into the local part of the address to escape the intended path segment and rewrite the request's path and query string. Because the rewritten request is still sent as the application's authenticated `POST` with its Microsoft Graph bearer token, the attacker can redirect it to other Graph endpoints within the token's scopes.\n\n### Details\n\nThe flaw is in `lib/swoosh/adapters/ms_graph.ex`. `api_endpoint_url/2` constructs the Graph endpoint by interpolating the email's `from` address into the path `/users/{from}/sendMail`. The `from` value is taken verbatim from the email struct and is neither percent-encoded nor validated against the RFC 5321 character set before being placed into the URL. `deliver/2` then issues an authenticated `POST` to that constructed URL using the application's Grap","public_affected_ranges":[">= 1.12.0, < 1.26.3"]}],"null_published_at":"2026-11-01T01:45:38.494Z","source_updated_at":"2026-10-16T19:22:32.000Z","source_disclosed_at":"2026-10-16T19:22:31.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:14:14.588Z"}],"next_cursor":null,"snapshot_revision":"42594"}