Scope KamoMail mailbox/domain listing to the org's own domains (cross-tenant leak)

FixEmailService
Shipped
July 8, 2026 at 10:32 PM UTC
Author
Kamo
Commit
0d782a8

SECURITY: **************** ran 'SELECT email FROM virtual_users' (and **************** 'SELECT name FROM virtual_domains') with no org scoping, so mailbox/domain sync imported EVERY org's KamoMail mailboxes into the caller's org — one org could see another org's private mailboxes (Option One had all of kamocrm's imported). Scope by org_domains (the DNS-verified ownership boundary — the one source the email sync itself can't pollute): listMailboxes filters out mailboxes on domains the org doesn't own (hides already-leaked rows immediately); syncMailboxes imports only own-domain mailboxes and prunes foreign rows from prior unscoped syncs; EmailDomainService.syncDomains no longer imports shared-server domains the org never registered. Adds **************** + isolation tests. Also: saveProviderConfig resets status to PENDING_SETUP when switching to an OAuth provider so a persisted selection isn't shown as falsely connected before the OAuth callback completes.

All changes

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.

Start Free ForeverView Pricing