This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+1 more
Affected surfaces
ReleasePort's take
Moderate signalThe release introduces a new read‑only REST API at /api/v1 and fixes several UI glitches, while critically addressing a cross‑account bypass vulnerability in the email handling components.
Why it matters: Severity 90 security fix eliminates cross‑account bypass for users lacking mailbox grants; developers should review EmailsController/EmailCoreService integration immediately.
Summary
AI summaryUpdates 🐛 Bug Fixes, ⚙️ Improvements, and ✨ New Features across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Closes cross-account bypass for users with no mailbox grants in EmailsController and EmailCoreService Closes cross-account bypass for users with no mailbox grants in EmailsController and EmailCoreService Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Adds optional read-only REST API (v1) under /api/v1 Adds optional read-only REST API (v1) under /api/v1 Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Adds spinner and disables search submit button during request Adds spinner and disables search submit button during request Source: llm_adapter@2026-07-15 Confidence: low |
— |
| Feature | Low |
Shows spinner and disables search submit button while search is in flight Shows spinner and disables search submit button while search is in flight Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | High |
Eliminates dark mode flash by applying theme synchronously via blocking inline script Eliminates dark mode flash by applying theme synchronously via blocking inline script Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Populates RawHeaders for M365/Graph-synced mail via internetMessageHeaders Populates RawHeaders for M365/Graph-synced mail via internetMessageHeaders Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Adapts dashboard chart colors to active theme and updates live on dark mode toggle Adapts dashboard chart colors to active theme and updates live on dark mode toggle Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fixes dashboard recent-emails timestamps and single-EML export Date header to use stored display timezone consistently Fixes dashboard recent-emails timestamps and single-EML export Date header to use stored display timezone consistently Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Renames dashboard storage tile label to "Database size" Renames dashboard storage tile label to "Database size" Source: llm_adapter@2026-07-15 Confidence: low |
— |
Full changelog
✨ New Features
- Read-only REST API (v1) - Optional, off-by-default REST API under
/api/v1for programmatic access to the archive (reporting, e-discovery, monitoring, AI agents) without exposing mailbox credentials or talking to the mail provider. See documentation here. Thanks to @kipp-ing for the PR!
⚙️ Improvements
- Search Loading Indicator - Search submit button shows a spinner and is disabled while the search request is in flight
- Dashboard Storage Label - Renamed the dashboard storage tile label to "Database size" to clarify it shows the database size, not mailbox storage
🐛 Bug Fixes
- Dark Mode Flash on Page Navigation - Theme is now applied synchronously via a blocking inline script in the
<head>before stylesheets load, eliminating the brief light-mode flash during page transitions - Zero-Grant Access Control - Closed cross-account bypass for users with no mailbox grants in EmailsController and EmailCoreService - M365 Graph Raw Headers - Populate RawHeaders for M365/Graph-synced mail via internetMessageHeaders,
- Dashboard Chart Dark Mode - Charts (monthly bar + top senders doughnut) now adapt text, grid, legend and tooltip colors to the active theme and update live when toggling dark mode
- Dashboard & Export Timezone - Fixed recent-emails timestamps on the dashboard being shifted by the configured display timezone offset (shown as UTC by the JS converter) and single-EML export emitting a wrong
Date:header; both now use the stored display-timezone value consistently with the emails index/details pages
Security Fixes
- Zero‑grant access control bypass closed in EmailsController and EmailCoreService
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About mail-archiver
Mail-Archiver is a web application for archiving, searching, and exporting emails from multiple accounts. Featuring folder sync, attachment support, mailbox migration and a dashboard.
Beta — feedback welcome: [email protected]