CVE-2026-86008
HighCVSS 7.2Summary
In Mailu, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions.
Risk Assessment
An attacker with domain manager privileges can take over an administrative account, leading to full compromise of the mail server. The risk includes unauthorized data access and potential for further attacks.
Recommendation
Update Mailu to a version containing commit 8577c929b4ade04d3cd4210cf036601abd793556. Review domain manager accounts and restrict their privileges to the minimum necessary.
Other vulnerabilities in Mailu
See all- CVE-2026-86009High
In Mailu, domain managers can enable spoofing for hosted domains they do not control. A malicious domain administrator can enable spoofing for another hosted domain and send emails authenticated with DKIM/SPF for domains they should not be able to.
- CVE-2026-85751Critical
Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3.
- CVE-2026-49217High
Mailu before version 2024.06.52 has a missing authorization check in the REST API, allowing any unauthenticated attacker to remove IP restrictions or update the comment field of any existing user token if the REST API is enabled. Upgrade to version 2024.06.52 includes a patch, and a workaround is to disable the REST API.
Original NVD description (English source)
Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS