Read the docs
TI-2024-15674 Aliases CVE-2024-23655

Attacker can prevent users from accessing received emails

Priority MEDIUM 40CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Tuta is an encrypted email service. Starting in version 3.118.12 and prior to version 3.119.10, an attacker is able to send a manipulated email so that the user can no longer use the app to get access to received emails. By sending a manipulated email, an attacker could put the app into an unusable state. In this case, a user can no longer access received e-mails. Since the vulnerability affects not only the app, but also the web application, a user in this case has no way to access received emails. This issue was tested with iOS and the web app, but it is possible all clients are affected. Version 3.119.10 fixes this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00788 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed tutanota (tutao): 3.119.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tutaotutanota3.118.12 to before 3.119.103.119.10Patch availableCNA
  • tutanota Vendortutao Affected 3.118.12 to before 3.119.10 Fixed in 3.119.10 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tuta:tutanota:*:*:*:*:*:*:*:*3.118.12 to before 3.119.10Vulnerabletutao
  • cpe:2.3:a:tuta:tutanota:*:*:*:*:*:*:*:* Versions 3.118.12 to before 3.119.10 Vulnerable ·tutao

Remediation

  • Fix · CNA tutanota (tutao) Fixed in 3.119.10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-23655

References

Exploit 1

Other 1

  • TI-2023-24758 Remote Code Execution via insufficiently sanitized call to shell.openExternal CVSS 3.1CRITICAL 9.3
  • TI-2024-15432 Tuta loads images from external resources CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences