CVE-2025-27913

CVE-2025-27913 describes a vulnerability in Passbolt API versions prior to 5, where a misconfigured server can be tricked into sending email messages with a domain name derived from an attacker-controlled HTTP Host header. This high-severity vulnerability (CVSS 7.5) is easily exploitable over the network with low attack complexity, potentially leading to high integrity impacts such as spoofed emails, though it does not affect confidentiality or availability. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.