AIKIDO-2026-647631

TL;DR

Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the path /users/{from}/sendMail without percent-encoding or validation. In lib/swoosh/adapters/ms_graph.ex, api_endpoint_url/2 places the from value verbatim into the URL, and deliver/2 issues an authenticated POST to that constructed endpoint using the application's Graph bearer token. In applications that derive the from address from untrusted or user-influenced input (such as a relay, contact form, or send-as feature), an attacker can inject URL-special characters (/, ?, #) into the local part of the address to escape the intended path segment and rewrite the request's path and query string. Because the redirected request is still sent with the application's Microsoft Graph credentials, the attacker can steer it to other Graph endpoints within the token's scopes. Applications that always send with a fixed, trusted from address are not affected.