CVE-2026-86008: fallo de gravedad alta en Mailu
Mailu domain managers can take over higher-privileged accounts
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.2epss 0.3%
Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Mailu · MailuCVEs relacionadas — Mailu
En el mismo producto, de las más peligrosas a las menos.
CVE-2020-5239HIGHUnspecified vulnerability in the fetchmail script in MailuEPSS 0.9%CVE-2026-85751CRITICALMailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trustEPSS 0.6%CVE-2026-86009HIGHMailu: Domain managers can allow themselves to spoof on other hosted domains they should not controlEPSS 0.4%CVE-2026-49217HIGHMailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictionsEPSS 0.4%