---
id: CVE-2026-54649
title: >-
  punchin-email is a Cloudflare Email Worker that provides two-way role aliases
  while relaying mail to a private inbox
summary: >-
  punchin-email is a Cloudflare Email Worker that provides two-way role aliases
  while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers
  inbound alias mail with message.forward(), which silently drops the added
  Reply-…
severity: low
cvss: 2.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-200
  - CWE-201
vendor: PunchIn-App
product: punchin-email
affected:
  - punchin-email < 1.5.0
published: '2026-09-17'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:17:17.103'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54649'
references:
  - url: >-
      https://github.com/PunchIn-App/punchin-email/commit/593685ffc0b8eb3949a4838e7bfe1e97b953d084
    label: security-advisories@github.com
  - url: 'https://github.com/PunchIn-App/punchin-email/pull/66'
    label: security-advisories@github.com
  - url: 'https://github.com/PunchIn-App/punchin-email/releases/tag/v1.5.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/PunchIn-App/punchin-email/security/advisories/GHSA-2ph7-69xm-hmwv
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-24T20:39:47.675180Z'
cvssSource: cna
epss: 0.00838
epssPercentile: 0.55945
ingestedAt: '2026-09-17T19:26:25.318Z'
---

## Overview

punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward(), which silently drops the added Reply-To header intended to route responses through the relay. When a correspondent sends mail to an alias and the operator replies, the mail client can send directly to the correspondent from the private FORWARD_TO inbox address, exposing that address. The disclosure is limited to the operator's own email address and does not expose third-party data or provide code execution or authentication bypass. This issue is fixed in version 1.5.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.