CVE-2026-29133 is a critical flaw (CVSS 9.1) in SEPPmail Secure Email Gateway. Before version 15.0.3, an attacker could upload PGP keys whose user IDs did not match their own email address. The vendor fixed it in 15.0.3, so update to that release or a later one.
What's affected
The NVD record lists SEPPmail Secure Email Gateway before version 15.0.3. The vendor's release notes for that version name the issue UID Regex Bypass and list it with severity Low, while NVD scores it 9.1. Treat the higher number as your planning figure and read the notes.
Organisations that accept PGP keys through the gateway are the ones affected.
How to check if you're exposed
Check your appliance version in the SEPPmail admin interface and compare it with 15.0.3. The vendor publishes release notes at downloads.seppmail.com, and the section titled SEPPmail Vulnerability Disclosure 15.0.3 lists the fixed issues. If you run an older major release, the record does not say which other versions are affected, so ask SEPPmail support or read the release notes for your branch. Then review the PGP keys held on the gateway for entries whose user IDs do not match the sender or domain that supplied them.
What to do now
- Update to SEPPmail 15.0.3 or later.
- Audit uploaded PGP keys and remove any where the user ID does not belong to the account that uploaded it.
- Check whether any recipients have been sending encrypted mail to a key you cannot tie to a real person.
- Where you can, confirm important keys with the owner through a second channel.
- Record the key review and the update in your change log.
Why it matters
The record files this under CWE-20, improper input validation. A PGP key binds an identity, the user ID, to a public key, and mail systems use that binding to decide who may receive or sign. If the check that ties a key to its owner can be bypassed, an attacker can place a key under an identity that is not theirs.
The vendor's own severity label is lower than the NVD score, which is common when the impact depends on how the feature is used in your mail flow. The release notes carry the vendor's wording, and the record has no more detail. The record does not mark this as exploited in the wild.
Quick check
Why do the vendor and NVD severity differ?
The vendor rates it Low and NVD scores it 9.1. Plan around the higher score, and read the vendor note for context.
What is a UID in PGP?
The user ID is the name and email address attached to a key.
Sources
Last reviewed: 19 October 2026.
