CVE-2026-119705

CVE-2026-119705 is a missing authentication vulnerability affecting SerpBear, an open-source search engine position tracking tool, in versions prior to 3.1.1. The flaw resides in the `/api/notify` endpoint (specifically within `pages/api/notify.ts`), where the application fails to call the `verifyUser()` function. This omission allows remote, unauthenticated attackers to access the endpoint without needing any credentials or user interaction. By exploiting this vulnerability, an attacker can repeatedly send POST requests to the `/api/notify` endpoint, optionally including a domain parameter. This action triggers unauthorized notification emails, which can exhaust the organization's SMTP service rate limits, trigger abuse flags from email providers, and flood recipients' inboxes. To resolve this issue, users are advised to upgrade their SerpBear installations to version 3.1.1 or later.