VulnerabilityAnalyzed

CVE-2026-42865

This vulnerability is fixed in 2.29.3.

LOW 2.3EPSS 0.23%

Does this matter?

Lower severity and a low EPSS score (0.23%). Track it; it rarely justifies an emergency change on its own.

Description

Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis subscription listener, which could deliver thread events for one authenticated account to another authenticated account using the cleaner feature at the same time. This vulnerability is fixed in 2.29.3.

CVSS 4.0: 2.3 LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.23% probability · 14th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: getinboxzero/inbox zero
Source: security-advisories@github.com

References

https://github.com/elie222/inbox-zero/commit/02341923b5460ce9630c4681a9b6461ba466688aPatch
https://github.com/elie222/inbox-zero/security/advisories/GHSA-f3gp-v7cj-2569Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.