Basecamp · Report #2012659
Spam & Clearance checks disabled with existing referenced Message-ID
Validstatus
lowseverity
$250bounty
123upvotes
21 Jan 2026disclosed
Summary
Summary
A vulnerability in HEY's inbound email processing could allow crafted emails to bypass spam filtering and The Screener when they appear to be in reply to an existing thread.
Impact
An attacker who obtained a valid Message-ID from a target's mailbox could send emails that bypassed HEY's spam detection and appeared directly in existing threads, even when the mail server flagged them as spam.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.