CVE-2026-86008highCWE-269CWE-285

CVE-2026-86008: high-severity vulnerability in Mailu

Mailu domain managers can take over higher-privileged accounts

Published

Follow this CVE+ Monitor Mailu

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 0.3%
Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Mailu · Mailu
Related CVEs — Mailu

In the same product, most dangerous first.

CVE-2020-5239HIGHUnspecified vulnerability in the fetchmail script in MailuEPSS 0.9%CVE-2026-85751CRITICALMailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trustEPSS 0.6%CVE-2026-86009HIGHMailu: Domain managers can allow themselves to spoof on other hosted domains they should not controlEPSS 0.4%CVE-2026-49217HIGHMailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictionsEPSS 0.4%