CVE-2026-57443

Published: Set 25, 2026 Last Modified: Set 25, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none

Description

AI Translation Available

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email` endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the `email_reader.py` subprocess, which connects to configured ProtonMail or Gmail accounts via IMAP and returns email metadata (sender, subject, body snippet) in the JSON response. The server binds to `0.0.0.0:8100` by default with CORS set to `allow_origins=['*']`, making it reachable from any network or browser origin. Version 4.2.1 patches the issue.

306

Missing Authentication for Critical Function

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control Other
Potential Impacts:
Gain Privileges Or Assume Identity Varies By Context
Applicable Platforms
Technologies: Cloud Computing, ICS/OT
Likelihood of Exploit: High
View CWE Details
https://github.com/issdandavis/SCBE-AETHERMOORE/commit/ca83…
https://github.com/issdandavis/SCBE-AETHERMOORE/commit/ca833795e01eab060e92572e…
https://github.com/issdandavis/SCBE-AETHERMOORE/commit/de77…
https://github.com/issdandavis/SCBE-AETHERMOORE/commit/de7779b722c501dbcf4eae95…
https://github.com/issdandavis/SCBE-AETHERMOORE/security/ad…
https://github.com/issdandavis/SCBE-AETHERMOORE/security/advisories/GHSA-q986-4…