All vulnerabilities
CVE-2026-86008GHSA-9pv5-rm76-3qwj

Mailu domain managers can take over higher-privileged accounts

Mailu Mailu
Open in ThreatlineRecord JSON
CVSS
7.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published16 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.

Text from CVE List

Affected versions 2

  • Mailuaffected: < 8577c929b4ade04d3cd4210cf036601abd793556CVE List
  • Mailu, mailu< 8577c929b4ade04d3cd4210cf036601abd793556GitHub

References 4