CVE-2019-7628

CVE-2019-7628 describes a vulnerability in Pagure version 5.2 where API keys are leaked to users via email, primarily due to the API token expiration reminder cron job. This flaw allows attackers to intercept these emails through man-in-the-middle attacks, as many email servers do not validate TLS certificates, thereby gaining unauthorized access to Pagure on behalf of other users. The vulnerability has a CVSS score of 5.9 (Medium), indicating a network-based attack vector with high confidentiality impact but high attack complexity due to the reliance on email interception. While the issue could lead to full account compromise, it does not affect integrity or availability. There is no evidence of active exploitation, nor is there publicly available exploit code in Metasploit or Nuclei. The CVE has received minimal community discussion and media coverage, suggesting a low level of public awareness or attention.