CVE-2026-90513NVD

Description

A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d. This issue affects the function SES.sendEmail of the file template.yml of the component API Gateway Endpoint. This manipulation of the argument toEmails/ccEmails/replyToEmails/subject/message causes missing authentication. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Severity Level

MEDIUM (6.5)

Published Date

13/09/2026

Last Modified

14/09/2026

Exploitation Status

????

EPSS Score

0.44% (percentile 37.6%)

CVSS Base Metrics

CVSS v3 (3.1)

MEDIUM 6.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:R

CVSS v4 (4.0)

MEDIUM 6.9

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

Weaknesses (CWE)

CWE-306 - Missing AuthenticationCWE-287 - Improper Authentication

Affected & Patched Versions

Product	Affected Versions	Patched Version
simalexan api-lambda-send-email-ses	bda6869aa81371d1e872242e74fe7d953edb818d	N/A

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.