Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-532.
Summary
Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK_AUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your Django error reports, an attacker could discover your ANYMAIL_WEBHOOK setting and use this to post fabricated or malicious Anymail tracking/inbound events to your app. This vulnerability appears to have been fixed in v1.4.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | django-anymail (PyPI) | 0.2 to before 1.4 | 1.4 | Patch available | GHSA-qh9x-mc42-vg4g |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- django-anymail (PyPI) Vendor— Affected 0.2 to before 1.4 Fixed in 1.4 Patch available GHSA-qh9x-mc42-vg4g
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:django-anymail_project:django-anymail:*:*:*:*:*:*:*:* | 0.2 – 1.3 | Vulnerable | Django-anymail Project |
- cpe:2.3:a:django-anymail_project:django-anymail:*:*:*:*:*:*:*:* Versions 0.2 – 1.3 Vulnerable ·Django-anymail Project
Remediation
- Fix · GHSA-qh9x-mc42-vg4g django-anymail (PyPI) Fixed in 1.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1000089
- 2026-10-03 Alias added: GHSA-qh9x-mc42-vg4g
References
Advisory 2
More Django-anymail Project Django-anymail vulnerabilities
- TI-2018-04862 webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack… CVSS 3.0CRITICAL 9.1
Sources
- CVE-2018-1000089 · CVE Program
- CVE-2018-1000089 · NVD
- FIRST EPSS
- GHSA-qh9x-mc42-vg4g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences