{"id":"CVE-2024-45438","aliases":["EUVD-2024-54897","GHSA-42jm-j2g5-xq6f"],"status":"published","title":"An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8...","description":"An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. The file quarantine.php within the SpamTitan interface allows unauthenticated users to trigger account-level actions using a crafted GET request. Notably, when a non-existent email address is provided as part of the email parameter, SpamTitan will automatically create a user record and associate quarantine settings with it - all without requiring authentication.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00586,"percentile":0.48335,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284","CWE-306"],"published":"2025-08-21T00:00:00Z","modified":"2026-06-17T07:54:12Z","references":[{"url":"https://docs.titanhq.com/en/13161-spamtitan-release-notes.html"},{"url":"https://www.titanhq.com/email-protection/"},{"url":"https://www.seralys.com/research/CVE-2024-45438.txt"},{"url":"https://seclists.org/fulldisclosure/2025/Sep/15"},{"url":"http://seclists.org/fulldisclosure/2025/Sep/15"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45438"},{"url":"https://www.titanhq.com/email-protection"},{"url":"https://github.com/advisories/GHSA-42jm-j2g5-xq6f"}],"sources":{"cve":[{"id":"CVE-2024-45438","description":"An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. The file quarantine.php within the SpamTitan interface allows unauthenticated users to trigger account-level actions using a crafted GET request. Notably, when a non-existent email address is provided as part of the email parameter, SpamTitan will automatically create a user record and associate quarantine settings with it - all without requiring authentication.","status":"published","published":"2025-08-21T00:00:00Z","modified":"2025-11-03T19:30:54.287Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-306","CWE-284"],"updated_at":"2026-11-02T14:34:08.16279Z"}],"euvd":[{"id":"EUVD-2024-54897","description":"An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. The file quarantine.php within the SpamTitan interface allows unauthenticated users to trigger account-level actions using a crafted GET request. Notably, when a non-existent email address is provided as part of the email parameter, SpamTitan will automatically create a user record and associate quarantine settings with it - all without requiring authentication.","status":"published","published":"2025-08-21T00:00:00Z","modified":"2025-11-03T19:30:54Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:33.639996Z"}],"ghsa":[{"id":"GHSA-42jm-j2g5-xq6f","title":"An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8...","description":"An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. The file quarantine.php within the SpamTitan interface allows unauthenticated users to trigger account-level actions using a crafted GET request. Notably, when a non-existent email address is provided as part of the email parameter, SpamTitan will automatically create a user record and associate quarantine settings with it - all without requiring authentication.","status":"published","published":"2025-08-21T18:31:28Z","modified":"2025-11-03T21:34:23Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:04:24.41654Z"}],"nvd":[{"id":"CVE-2024-45438","description":"An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. The file quarantine.php within the SpamTitan interface allows unauthenticated users to trigger account-level actions using a crafted GET request. Notably, when a non-existent email address is provided as part of the email parameter, SpamTitan will automatically create a user record and associate quarantine settings with it - all without requiring authentication.","status":"published","published":"2025-08-21T17:15:29.553Z","modified":"2026-06-17T07:54:12.85Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-284","CWE-306"],"updated_at":"2026-11-02T14:10:47.444899Z"}]}}