Re:Mailgun: Public Security Disclosure
by throwaway2346mg on Wednesday July 12, 2023 @05:15AM
(#36692090)
Yep - there are a number of scenarios:
- CRM system (obviously an issue)
- Inbound email automation (eg. action based on reply from user / admin / etc)
But really, any inbound action where you don't want someone to be able to trivially spoof the sender, when the sender has SPF/DKIM/DMARC all configured.
For people using Mailgun purely for marketing email purposes, this is unlikely to be an issue, as you're unlikely to be using inbound routes for automation/processing.
- CRM system (obviously an issue) - Inbound email automation (eg. action based on reply from user / admin / etc)
But really, any inbound action where you don't want someone to be able to trivially spoof the sender, when the sender has SPF/DKIM/DMARC all configured.
For people using Mailgun purely for marketing email purposes, this is unlikely to be an issue, as you're unlikely to be using inbound routes for automation/processing.