CVE-2026-86009 Details
Description
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.
A vulnerability in Mailu, a mail server distributed as Docker images, allows domain managers to spoof email addresses on domains they do not control. This issue affects Mailu versions prior to the commit f05aeb8322e2f61096af6b089d61ba6f40587d96. The vulnerability arises because domain managers can grant themselves or other users the 'allow-spoofing' permission, enabling them to send emails authenticated with DKIM/SPF for domains they should not have access to. The problem is exacerbated by the fact that the 'allow-spoofing' flag can be set for any user on the same Mailu instance, effectively allowing cross-domain spoofing.
The vulnerability has been addressed in the Mailu 'master' version. Domain managers should not be able to spoof email addresses on domains they do not control.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Mailu/Mailu/issues/2686 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/Mailu/Mailu/commit/f05aeb8322e2f61096af6b089d61ba6f40587d96 | [email protected] | Source CodeVendor |
| https://github.com/Mailu/Mailu/issues/2686 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/Mailu/Mailu/pull/4072 | [email protected] | Issue TrackingVendor |
| https://github.com/Mailu/Mailu/security/advisories/GHSA-crww-m82r-2wfm | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mailu | < f05aeb8322e2f61096af6b089d61ba6f40587d96 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |