Security vulnerabilities

Hello,

There is no issue/security flaw on our side, you can use identities with any email software and addresses. You tried alwaysdata.net addresses, but you could have tried with other domains.

Hello ,

Thanks for your response.

But my point is here that the attacker can use emails of the other registered users as shown in my poc too.

if user creates the mail address (vixtim@alwaysdata.net) for his own purposes in webmail

The issue is not about using arbitrary external addresses, but that the AlwaysData webmail allows sending emails using @alwaysdata.net addresses without verifying ownership or authorization. These are domain-owned identities, and the webmail does not restrict the “From” address to the authenticated user.

This results in cross-user impersonation within the AlwaysData domain, which is an authorization control issue.

Best regards,

You're referring to our webmail, where you're authenticated with your own `alwaysdata.net` email address, but you could do the same from any mail client.

Hello hdegorce ,

The concern remains that the AlwaysData webmail itself permits changing the “From” address to other @alwaysdata.net identities without ownership validation. Since these addresses are AlwaysData-managed accounts, the webmail is effectively allowing authenticated users to act as other internal users.

This is a missing authorization check at the application level, regardless of whether other mail clients can also do this.

For scenario :

Lets say you have webmail account with mail (hdegorce@alwaysdata.net) with your creds .
But with this issue an attacker can easily impersonate as you, and can send mail by your mail id to any one.

If you want poc for that let me know your mail address i'll try to send the mail from the victim account.

Thanks

No one would expect or want their email address to be used by someone else to send emails on their behalf.
For example, you would not want recipients to receive emails appearing to originate from your address when you did not send them yourself, as this breaks sender authenticity and undermines trust in the email system.

Thanks

But with this issue an attacker can easily impersonate as you, and can send mail by your mail id to any one.

An attacker can easily impersonate you even without that issue, as they could use any email application to do so.

But how he using the mail addresses of your registered users without any authorization? Isn't that concerning to you?