Is CVE-2026-119705 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-119705?

CVE-2026-119705 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-119705

Description

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser() is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust SMTP rate limits, trigger provider abuse flags and flood recipients.