SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2019-9149

Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API.

MEDIUM 6.5EPSS 0.89%

Does this matter?

Lower severity and a low EPSS score (0.89%). Track it; it rarely justifies an emergency change on its own.

Description

Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API. By modifying an URL parameter in Mailvelope, an attacker is able to sign (and encrypt) arbitrary messages with Mailvelope, assuming the private key password is cached. A second vulnerability allows an attacker to decrypt an arbitrary message when the GnuPG backend is used in Mailvelope.

CVSS 3.1
6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS
0.89% probability · 59th percentile
Public exploits
None in Exploit-DB
CISA KEV
Not listed
Weakness
CWE-347, CWE-863
Affected
mailvelope/mailvelope
Source
cve@mitre.org
EPSS trend
0%3%5%26 October 2026: 0.89%26 October 202626 October 2026

EPSS 0.9% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.