CVE-2026-22239

The vulnerability (CWE-400 — uncontrolled resource consumption) results from the lack of proper authentication mechanisms and access restrictions to the email sending API. An attacker sends specially crafted HTTP requests to the vulnerable API endpoint without needing any credentials. As a result, the server processes the requests and sends emails to any recipients, impersonating the domain or identity of the organization using Bluvoyix.

An attacker can send unsolicited or malicious emails without restrictions to any recipients on behalf of the company, which may lead to serious reputational damage, domain reputation breach, server placement on blacklists, and potential abuse for phishing or spam campaigns.

Patches available from the vendor should be applied according to the references. As a temporary workaround, it is recommended to restrict access to the email sending API endpoint at the firewall or application gateway (WAF) level to trusted sources only, and to implement authentication mechanisms and request rate limiting.

Blusparkglobal Bluvoyix product — versions indicated in the vendor's references