Apple account email address disclosure via Mail app

This is a follow-up to my July 10 blog post, Apple Hide My Email bug, possibly related to disclosure vulnerability. Yesterday I happened upon a Mastodon post that inspired me to continue researching my Mac Mail app bug: curl can be used to send emails with smtp I have multiple email accounts, for example with my personal domain lapcatsoftware.com here and my business domain underpassapp.com, but email clients such as Mail app do not provide me with full control over the sent email headers, whereas the curl command-line tool does. I can create a text file with arbitrary email headers, including, “X-Icloud-Hme”, and send the email with the following command (private information redacted): curl --ssl-reqd --url 'smtp://[redacted]' --user '[redacted]' --mail-from '[redacted]' --mail-rcpt '[redacted]' --upload-file ~/Desktop/email.txt Here’s an example email: From: [redacted] To: [redacted] Subject: Test Date: Sun, 19 Jul 2026 09:41:00 +0500 X-Icloud-Hme: p=Hide My Email…