CVE-2026-119705
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Oct 30, 2026
Vendor
unknown
Description
SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser() is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust SMTP rate limits, trigger provider abuse flags and flood recipients.