[cobalt-users] Re: NeoMail 1.25

[Andy Robinowitz <andy_robinowitz@xxxxxxxxx>]

I just installed the NeoMail 1.25 and was testing
the program and found what I think is a bug. 
John Doe who runs www.site1.com can login via
another site on the same server (for example
www.site2.com/neomail/).  Then John enters his
username/password combo (for site1) and he is
granted access even though he is not associated
with www.site2.com.  It looks like John can now
send messages as john@xxxxxxxxxx

This seems this might be a security issues to me?

Anyone else notice this?  

Thanks,

Andy Robinowitz
Organic Hosting, LLC
http://www.organichosting.com

__________________________________________________
Terrorist Attacks on U.S. - How can you help?
Donate cash, emergency relief information
http://dailynews.yahoo.com/fc/US/Emergency_Information/