### Email Functionality Abuse Vulnerability

Multiple types of abuse exist.

#### Email Bombing Vulnerability

##### Common Characteristics

- **Key Defect**: The email sending function has **no rate limiting** set, or the restrictions are insufficient (e.g., missing CAPTCHA, human verification, etc.), enabling automated bulk sending of emails.
- **Aggravating Characteristics**: The email bombing vulnerability can exist even without the following characteristics, but the impact is worsened when they are present:
    - Allows direct or indirect control of email recipients
    - Allows control of some or all of the email content; even if the content is not controllable, fixed-content emails can flood the target inbox and consume email service quota

##### No-Risk Special Case

The email sending logic is entirely controlled internally and cannot be triggered externally (directly or indirectly), such as automatically sending alert emails.

#### Email Content Forgery

##### Common Characteristics

- **Key Defect**: When constructing email content or reset links, review the risk of directly concatenating frontend-passed parameters (such as URLs, Host, custom text) into the email template without whitelist validation (leading to phishing content injection).
> The key issue is that users can control the email content. Even if special characters are filtered, it cannot prevent exploitation for phishing attacks. The best practice is to not allow users to control email content.
