CVE-2026-86008 Details
Description
Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.
A vulnerability in Mailu, a mail server distributed as Docker images, allows domain managers to reset passwords or obtain tokens for higher-privileged accounts. This issue exists in Mailu versions prior to the commit 8577c929b4ade04d3cd4210cf036601abd793556. The vulnerability arises because the authorization for certain actions is based solely on the target's domain, without considering the relative privileges of the users involved. As a result, a domain manager could take control of a global admin or another domain manager's account by manipulating password resets or token creations.
The vulnerability has been addressed in the Mailu master branch. Users should update to the latest version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Mailu/Mailu/commit/8577c929b4ade04d3cd4210cf036601abd793556 | [email protected] | Source CodeVendor |
| https://github.com/Mailu/Mailu/issues/2685 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/Mailu/Mailu/pull/4050 | [email protected] | Issue TrackingSource CodeVendor |
| https://github.com/Mailu/Mailu/security/advisories/GHSA-9pv5-rm76-3qwj | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mailu | < 8577c929b4ade04d3cd4210cf036601abd793556 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | New CVE Received | [email protected] |
| Oct 16, 2026 | CVE Modified | CISA-ADP |