CVE-2018-1000089: Anymail django-anymail WEBHOOK_AUTHORIZATION Vulnerability
Summary
CVE-2018-1000089: Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK_AUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email track... Affects django-anymail across 2 version ranges.
>= 0.2, < 1.4
< 1a6086f2b58478d71f89bf27eb034ed81aefe5ef
Fixed in 1a6086f2b58478d71f89bf27eb034ed81aefe5ef. How to fix ↓
Also tracked for
- django-anymail · Debian:11
The same CVE-2018-1000089 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
django-anymail is a package for Django that provides a simple way to send email using one or more third-party email service providers. It allows developers to integrate their Django applications with various email service providers, such as Mailgun, SendGrid, and Amazon SES. The vulnerability in version 0.2 through 1.3 of django-anymail lies in the WEBHOOK_AUTHORIZATION setting value. This setting is used to authenticate incoming webhook requests. However, due to a CWE-532 and CWE-209 vulnerability, an attacker with access to error logs could fabricate email tracking events. By exploiting this vulnerability, an attacker who has discovered the ANYMAIL_WEBHOOK setting in exposed Django error reports could post fabricated or malicious Anymail tracking/inbound events to the targeted application.
Vulnerability Detail
The vulnerability in django-anymail allows an attacker to fabricate email tracking events by exploiting the WEBHOOK_AUTHORIZATION setting value. This can lead to various consequences, such as the manipulation of email tracking data, false reporting of email delivery, and potential disruption of email communication. The vulnerability can be exploited if the Django error reports are exposed and the attacker discovers the ANYMAIL_WEBHOOK setting. The issue has been assigned the CVE identifier CVE-2018-1000089 and has been fixed in version 1.4 of django-anymail.
How To Fix
Latest published version: 15.2.0 as of 23 Oct 2026
pip install --upgrade "django-anymail==15.2.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1a6086f2b58478d71f89bf27eb034ed81aefe5ef
This is the first release that contains the fix.
pip install --upgrade "django-anymail==1a6086f2b58478d71f89bf27eb034ed81aefe5ef"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a workaround can be implemented by ensuring that the Django error reports are not exposed to potential attackers. This can be achieved by securing the error logs and limiting access to authorized personnel only.
Conclusion
The vulnerability in django-anymail version 0.2 through 1.3 allows attackers to fabricate email tracking events by exploiting the WEBHOOK_AUTHORIZATION setting value. To mitigate this vulnerability, it is recommended to upgrade to version 1.4 or later of django-anymail. If immediate upgrade is not possible, securing the Django error reports and limiting access to authorized personnel can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django-anymail →
FAQ
django-anymail is a package for Django that allows developers to integrate their applications with various email service providers.
The vulnerability allows an attacker to fabricate email tracking events, potentially leading to the manipulation of email tracking data and false reporting of email delivery.
The vulnerability can be fixed by upgrading django-anymail to version 1.4 or later.
Yes, a workaround is available by securing the Django error reports and limiting access to authorized personnel only.
Yes, the vulnerability has been fixed in version 1.4 of django-anymail.
References
Related vulnerabilities
Recent vulnerabilities recorded for django-anymail.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
