---
id: CVE-2026-50167
title: >-
  Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and
  storage
summary: >-
  Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and
  storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving
  webhook and identity resources did not enforce ownership checks for
  authenticated API…
severity: none
cwe:
  - CWE-639
published: '2026-08-18'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50167'
references:
  - url: >-
      https://github.com/kurrier-org/kurrier/commit/22fad36fb1bc79e3038184ddd485fb235217475c
    label: security-advisories@github.com
  - url: 'https://github.com/kurrier-org/kurrier/pull/446'
    label: security-advisories@github.com
  - url: 'https://github.com/kurrier-org/kurrier/releases/tag/v1.2.4'
    label: security-advisories@github.com
  - url: >-
      https://github.com/kurrier-org/kurrier/security/advisories/GHSA-f7h3-f5vh-3764
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00465
epssPercentile: 0.37532
ingestedAt: '2026-09-18T20:51:25.634Z'
---

## Overview

Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use another account's identifiers to read and enumerate webhook and identity resources belonging to that account through apps/worker/server/routes/api/kurrier/webhooks/[id].get.ts, apps/worker/server/routes/api/kurrier/webhooks/index.get.ts, apps/worker/server/routes/api/kurrier/identities/[id].get.ts, and apps/worker/server/routes/api/kurrier/identities/index.get.ts. Anonymous requests and invalid API keys were rejected, and cross-user modification operations were blocked, but affected GET and list operations could expose another user's resource metadata. This issue is fixed in version 1.2.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.