{"schema":"threatline.record/2","record":{"id":"CVE-2026-86008","aliases":["GHSA-9pv5-rm76-3qwj"],"summary":"Mailu domain managers can take over higher-privileged accounts","details":"Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.","categories":["Unclassified"],"product":"Mailu","vendor":"Mailu","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-86008","source_modified_at":"2026-10-16T16:53:59.579Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Mailu","vendor":"Mailu","versions":[{"status":"affected","version":"< 8577c929b4ade04d3cd4210cf036601abd793556"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/Mailu/Mailu/security/advisories/GHSA-9pv5-rm76-3qwj","source_modified_at":"2026-09-23T14:13:45Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"ecosystem":"mailu","name":"Mailu"},"range":"< 8577c929b4ade04d3cd4210cf036601abd793556"}],"fixed_versions":[],"cvss":7.2,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00314,"percentile":0.23073,"score_date":"2026-10-23"},"published_at":"2026-10-16T16:16:51.097Z","modified_at":"2026-10-16T16:53:59.579Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-86008","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T16:53:59.579Z"},{"source":"GitHub Advisory Database","url":"https://github.com/Mailu/Mailu/security/advisories/GHSA-9pv5-rm76-3qwj","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-23T14:13:45Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86008","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/Mailu/Mailu/security/advisories/GHSA-9pv5-rm76-3qwj","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/Mailu/Mailu/issues/2685","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/Mailu/Mailu/pull/4050","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/Mailu/Mailu/commit/8577c929b4ade04d3cd4210cf036601abd793556","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-16T16:53:48.473995Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-16T16:53:59.579Z","content_hash":"7f81e0d21235007df66ef401b9e47d9e9f108f45f1acad4d64ca660242d17b32"}}