CVE-2024-23655

Tuta is an encrypted email service. Starting in version 3.118.12 and prior to version 3.119.10, an attacker is able to send a manipulated email so that the user can no longer use the app to get access to received emails. By sending a manipulated email, an attacker could put the app into an unusable state. In this case, a user can no longer access received e-mails. Since the vulnerability affects not only the app, but also the web application, a user in this case has no way to access received emails. This issue was tested with iOS and the web app, but it is possible all clients are affected. Version 3.119.10 fixes this issue.

• CWE-20

• https://github.com/tutao/tutanota/releases/tag/tutanota-release-3.119.10Release Notes
• https://github.com/tutao/tutanota/security/advisories/GHSA-5h47-g927-629gExploit, Vendor Advisory
• https://github.com/tutao/tutanota/releases/tag/tutanota-release-3.119.10Release Notes
• https://github.com/tutao/tutanota/security/advisories/GHSA-5h47-g927-629gExploit, Vendor Advisory

Published

Jan 25, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-2365A vulnerability classified as problematic was found in Music…4.2
• CVE-2024-23650BuildKit is a toolkit for converting source code to build ar…5.3
• CVE-2024-23651BuildKit is a toolkit for converting source code to build ar…7.4
• CVE-2024-23652BuildKit is a toolkit for converting source code to build ar…9.1
• CVE-2024-23653BuildKit is a toolkit for converting source code to build ar…9.8
• CVE-2024-23654discourse-ai is the AI plugin for the open-source discussion…7.2
• CVE-2024-23656Dex is an identity service that uses OpenID Connect to drive…7.5
• CVE-2024-23657Nuxt is a free and open-source framework to create full-stac…8.8
• CVE-2024-23658In camera driver, there is a possible use after free due to …4.4
• CVE-2024-23659SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the…6.1
• CVE-2024-2366A remote code execution vulnerability exists in the parisneo…9
• CVE-2024-23660The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbb…7.5