CVE-2026-86009
HighCVSS 8.2Summary
In Mailu, domain managers can enable spoofing for hosted domains they do not control. A malicious domain administrator can enable spoofing for another hosted domain and send emails authenticated with DKIM/SPF for domains they should not be able to.
Risk Assessment
An attacker can send spoofed emails on behalf of domains they do not manage, potentially leading to phishing and loss of domain trust. The risk includes compromise of email communication integrity in the organization.
Recommendation
Update Mailu to a version containing commit f05aeb8322e2f61096af6b089d61ba6f40587d96. Verify DKIM/SPF configuration for all hosted domains and restrict domain manager privileges.
Other vulnerabilities in Mailu
See all- CVE-2026-86008High
In Mailu, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions.
- CVE-2026-85751Critical
Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3.
- CVE-2026-49217High
Mailu before version 2024.06.52 has a missing authorization check in the REST API, allowing any unauthenticated attacker to remove IP restrictions or update the comment field of any existing user token if the REST API is enabled. Upgrade to version 2024.06.52 includes a patch, and a workaround is to disable the REST API.
Original NVD description (English source)
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS