Affected: N-able Mail Assure

N-able Mail Assure through 2025-12-09 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server accepts arbitrary sender domains without enforcing any domain-to-account binding. As a result, an attacker from any tenant can impersonate other tenant domains, producing messages that pass SPF and DMARC validation, including strict p=reject policies. NOTE: the Supplier disputes this, stating that the reported behavior is intended functionality of its shared SMTP relay service. On 5 May 2026 the MITRE TL-Root, acting as adjudicator under the CVE Record Dispute Policy, determined that the issue meets the criteria for CVE assignment and instructed the MITRE CNA-LR to assign and publish CVE-2025-68624 with the DISPUTED tag. This GCVE record was published by GNA 128 (bcsec) on 31 August 2026, while CVE-2025-68624 was still in RESERVED state, to make the vulnerability information publicly available and citable in the meantime. The CVE Record was published on 14 September 2026 with the DISPUTED and exclusively-hosted-service tags. The CVSS 4.0 assessment published in this record uses Attack Requirements: Present (AT:P), applying the Supplier's own stated precondition that the impersonated domain must be an independently onboarded and DNS-verified customer of the platform. That precondition is…