Search
Find a vulnerability
Search criteria
10 vulnerabilities by Mailu
CVE-2026-86009 (GCVE-0-2026-86009)
Vulnerability from nvd – Published: 2026-10-16 16:19 – Updated: 2026-10-16 16:19
VLAI
EPSS
VEX
Title
Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control
Summary
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.
Severity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Mailu/Mailu/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/Mailu/Mailu/issues/2686 | x_refsource_MISC |
| https://github.com/Mailu/Mailu/pull/4072 | x_refsource_MISC |
| https://github.com/Mailu/Mailu/commit/f05aeb8322e… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Mailu",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003c f05aeb8322e2f61096af6b089d61ba6f40587d96"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:19:06.420Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Mailu/Mailu/security/advisories/GHSA-crww-m82r-2wfm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-crww-m82r-2wfm"
},
{
"name": "https://github.com/Mailu/Mailu/issues/2686",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/issues/2686"
},
{
"name": "https://github.com/Mailu/Mailu/pull/4072",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/pull/4072"
},
{
"name": "https://github.com/Mailu/Mailu/commit/f05aeb8322e2f61096af6b089d61ba6f40587d96",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/commit/f05aeb8322e2f61096af6b089d61ba6f40587d96"
}
],
"source": {
"advisory": "GHSA-crww-m82r-2wfm",
"discovery": "UNKNOWN"
},
"title": "Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-86009",
"datePublished": "2026-10-16T16:19:06.420Z",
"dateReserved": "2026-09-04T19:17:36.246Z",
"dateUpdated": "2026-10-16T16:19:06.420Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86008 (GCVE-0-2026-86008)
Vulnerability from nvd – Published: 2026-10-16 16:16 – Updated: 2026-10-16 16:53
VLAI
EPSS
VEX
Title
Mailu domain managers can take over higher-privileged accounts
Summary
Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:53 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Mailu/Mailu/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/Mailu/Mailu/issues/2685 | x_refsource_MISC |
| https://github.com/Mailu/Mailu/pull/4050 | x_refsource_MISC |
| https://github.com/Mailu/Mailu/commit/8577c929b4a… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86008",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:53:48.473995Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:53:59.579Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Mailu",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003c 8577c929b4ade04d3cd4210cf036601abd793556"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account\u0027s permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:16:51.097Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Mailu/Mailu/security/advisories/GHSA-9pv5-rm76-3qwj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-9pv5-rm76-3qwj"
},
{
"name": "https://github.com/Mailu/Mailu/issues/2685",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/issues/2685"
},
{
"name": "https://github.com/Mailu/Mailu/pull/4050",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/pull/4050"
},
{
"name": "https://github.com/Mailu/Mailu/commit/8577c929b4ade04d3cd4210cf036601abd793556",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/commit/8577c929b4ade04d3cd4210cf036601abd793556"
}
],
"source": {
"advisory": "GHSA-9pv5-rm76-3qwj",
"discovery": "UNKNOWN"
},
"title": "Mailu domain managers can take over higher-privileged accounts"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-86008",
"datePublished": "2026-10-16T16:16:51.097Z",
"dateReserved": "2026-09-04T19:17:36.246Z",
"dateUpdated": "2026-10-16T16:53:59.579Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85751 (GCVE-0-2026-85751)
Vulnerability from nvd – Published: 2026-09-21 15:39 – Updated: 2026-09-21 17:56
VLAI
EPSS
VEX
Title
Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust
Summary
Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 17:56 UTC
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/Mailu/Mailu/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/Mailu/Mailu/pull/4070 | x_refsource_MISC |
| https://github.com/Mailu/Mailu/pull/4071 | x_refsource_MISC |
| https://github.com/Mailu/Mailu/commit/dffa97cbd88… | x_refsource_MISC |
| https://github.com/Mailu/Mailu/commit/ff4003d0457… | x_refsource_MISC |
| https://github.com/Mailu/Mailu/releases/tag/2024.06.55 | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mailu | Mailu |
Affected:
>= 2.0.0, < 2024.06.55
|
|
| Mailu | helm-charts |
Affected:
< 2.7.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85751",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T17:56:04.999383Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T17:56:14.484Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Mailu",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 2024.06.55"
}
]
},
{
"product": "helm-charts",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003c 2.7.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290: Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-807",
"description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:39:24.774Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Mailu/Mailu/security/advisories/GHSA-rfhj-4wcq-74xg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-rfhj-4wcq-74xg"
},
{
"name": "https://github.com/Mailu/Mailu/pull/4070",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/pull/4070"
},
{
"name": "https://github.com/Mailu/Mailu/pull/4071",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/pull/4071"
},
{
"name": "https://github.com/Mailu/Mailu/commit/dffa97cbd889ab208246372ce9c86e99abb27ae9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/commit/dffa97cbd889ab208246372ce9c86e99abb27ae9"
},
{
"name": "https://github.com/Mailu/Mailu/commit/ff4003d045753013470945336448dbd790cac778",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/commit/ff4003d045753013470945336448dbd790cac778"
},
{
"name": "https://github.com/Mailu/Mailu/releases/tag/2024.06.55",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/releases/tag/2024.06.55"
}
],
"source": {
"advisory": "GHSA-rfhj-4wcq-74xg",
"discovery": "UNKNOWN"
},
"title": "Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85751",
"datePublished": "2026-09-21T15:39:24.774Z",
"dateReserved": "2026-09-04T14:50:16.721Z",
"dateUpdated": "2026-09-21T17:56:14.484Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49217 (GCVE-0-2026-49217)
Vulnerability from nvd – Published: 2026-08-20 22:01 – Updated: 2026-08-25 15:33
VLAI
EPSS
VEX
Title
Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions
Summary
Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is enabled. Upgrade to Mailu 2024.06.52 to receive a patch or, as a workaround, turn the REST API off.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 15:33 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/Mailu/Mailu/security/advisorie… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49217",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T15:33:13.726822Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T15:33:28.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Mailu",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003c 2024.06.52"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is enabled. Upgrade to Mailu 2024.06.52 to receive a patch or, as a workaround, turn the REST API off."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T22:01:41.588Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2w8v-6xr5-g9gh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2w8v-6xr5-g9gh"
}
],
"source": {
"advisory": "GHSA-2w8v-6xr5-g9gh",
"discovery": "UNKNOWN"
},
"title": "Mailu missing authentication on PATCH /api/v1/token/\u003cid\u003e, which allows unauthenticated removal of IP restrictions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49217",
"datePublished": "2026-08-20T22:01:41.588Z",
"dateReserved": "2026-05-28T03:42:34.341Z",
"dateUpdated": "2026-08-25T15:33:28.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2020-5239 (GCVE-0-2020-5239)
Vulnerability from nvd – Published: 2020-02-13 00:20 – Updated: 2024-08-04 08:22
VLAI
EPSS
VEX
Title
Unspecified vulnerability in the fetchmail script in Mailu
Summary
In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afterwards, see https://github.com/Mailu/Mailu/issues/1354
Severity
8.7 (High)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Mailu/Mailu/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/Mailu/Mailu/issues/1354 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:22:09.018Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Mailu/Mailu/issues/1354"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Mailu",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afterwards, see https://github.com/Mailu/Mailu/issues/1354"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-13T00:20:13.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/issues/1354"
}
],
"source": {
"advisory": "GHSA-2467-p5gv-58q6",
"discovery": "UNKNOWN"
},
"title": "Unspecified vulnerability in the fetchmail script in Mailu",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2020-5239",
"STATE": "PUBLIC",
"TITLE": "Unspecified vulnerability in the fetchmail script in Mailu"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Mailu",
"version": {
"version_data": [
{
"version_value": "\u003c 1.7"
}
]
}
}
]
},
"vendor_name": "Mailu"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afterwards, see https://github.com/Mailu/Mailu/issues/1354"
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-863: Incorrect Authorization"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6",
"refsource": "CONFIRM",
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6"
},
{
"name": "https://github.com/Mailu/Mailu/issues/1354",
"refsource": "MISC",
"url": "https://github.com/Mailu/Mailu/issues/1354"
}
]
},
"source": {
"advisory": "GHSA-2467-p5gv-58q6",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2020-5239",
"datePublished": "2020-02-13T00:20:13.000Z",
"dateReserved": "2020-01-02T00:00:00.000Z",
"dateUpdated": "2024-08-04T08:22:09.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-86009 (GCVE-0-2026-86009)
Vulnerability from cvelistv5 – Published: 2026-10-16 16:19 – Updated: 2026-10-16 16:19
VLAI
EPSS
VEX
Title
Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control
Summary
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.
Severity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Mailu/Mailu/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/Mailu/Mailu/issues/2686 | x_refsource_MISC |
| https://github.com/Mailu/Mailu/pull/4072 | x_refsource_MISC |
| https://github.com/Mailu/Mailu/commit/f05aeb8322e… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Mailu",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003c f05aeb8322e2f61096af6b089d61ba6f40587d96"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:19:06.420Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Mailu/Mailu/security/advisories/GHSA-crww-m82r-2wfm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-crww-m82r-2wfm"
},
{
"name": "https://github.com/Mailu/Mailu/issues/2686",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/issues/2686"
},
{
"name": "https://github.com/Mailu/Mailu/pull/4072",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/pull/4072"
},
{
"name": "https://github.com/Mailu/Mailu/commit/f05aeb8322e2f61096af6b089d61ba6f40587d96",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/commit/f05aeb8322e2f61096af6b089d61ba6f40587d96"
}
],
"source": {
"advisory": "GHSA-crww-m82r-2wfm",
"discovery": "UNKNOWN"
},
"title": "Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-86009",
"datePublished": "2026-10-16T16:19:06.420Z",
"dateReserved": "2026-09-04T19:17:36.246Z",
"dateUpdated": "2026-10-16T16:19:06.420Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86008 (GCVE-0-2026-86008)
Vulnerability from cvelistv5 – Published: 2026-10-16 16:16 – Updated: 2026-10-16 16:53
VLAI
EPSS
VEX
Title
Mailu domain managers can take over higher-privileged accounts
Summary
Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:53 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Mailu/Mailu/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/Mailu/Mailu/issues/2685 | x_refsource_MISC |
| https://github.com/Mailu/Mailu/pull/4050 | x_refsource_MISC |
| https://github.com/Mailu/Mailu/commit/8577c929b4a… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86008",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:53:48.473995Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:53:59.579Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Mailu",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003c 8577c929b4ade04d3cd4210cf036601abd793556"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account\u0027s permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:16:51.097Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Mailu/Mailu/security/advisories/GHSA-9pv5-rm76-3qwj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-9pv5-rm76-3qwj"
},
{
"name": "https://github.com/Mailu/Mailu/issues/2685",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/issues/2685"
},
{
"name": "https://github.com/Mailu/Mailu/pull/4050",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/pull/4050"
},
{
"name": "https://github.com/Mailu/Mailu/commit/8577c929b4ade04d3cd4210cf036601abd793556",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/commit/8577c929b4ade04d3cd4210cf036601abd793556"
}
],
"source": {
"advisory": "GHSA-9pv5-rm76-3qwj",
"discovery": "UNKNOWN"
},
"title": "Mailu domain managers can take over higher-privileged accounts"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-86008",
"datePublished": "2026-10-16T16:16:51.097Z",
"dateReserved": "2026-09-04T19:17:36.246Z",
"dateUpdated": "2026-10-16T16:53:59.579Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85751 (GCVE-0-2026-85751)
Vulnerability from cvelistv5 – Published: 2026-09-21 15:39 – Updated: 2026-09-21 17:56
VLAI
EPSS
VEX
Title
Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust
Summary
Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 17:56 UTC
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/Mailu/Mailu/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/Mailu/Mailu/pull/4070 | x_refsource_MISC |
| https://github.com/Mailu/Mailu/pull/4071 | x_refsource_MISC |
| https://github.com/Mailu/Mailu/commit/dffa97cbd88… | x_refsource_MISC |
| https://github.com/Mailu/Mailu/commit/ff4003d0457… | x_refsource_MISC |
| https://github.com/Mailu/Mailu/releases/tag/2024.06.55 | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mailu | Mailu |
Affected:
>= 2.0.0, < 2024.06.55
|
|
| Mailu | helm-charts |
Affected:
< 2.7.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85751",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T17:56:04.999383Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T17:56:14.484Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Mailu",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 2024.06.55"
}
]
},
{
"product": "helm-charts",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003c 2.7.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290: Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-807",
"description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:39:24.774Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Mailu/Mailu/security/advisories/GHSA-rfhj-4wcq-74xg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-rfhj-4wcq-74xg"
},
{
"name": "https://github.com/Mailu/Mailu/pull/4070",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/pull/4070"
},
{
"name": "https://github.com/Mailu/Mailu/pull/4071",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/pull/4071"
},
{
"name": "https://github.com/Mailu/Mailu/commit/dffa97cbd889ab208246372ce9c86e99abb27ae9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/commit/dffa97cbd889ab208246372ce9c86e99abb27ae9"
},
{
"name": "https://github.com/Mailu/Mailu/commit/ff4003d045753013470945336448dbd790cac778",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/commit/ff4003d045753013470945336448dbd790cac778"
},
{
"name": "https://github.com/Mailu/Mailu/releases/tag/2024.06.55",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/releases/tag/2024.06.55"
}
],
"source": {
"advisory": "GHSA-rfhj-4wcq-74xg",
"discovery": "UNKNOWN"
},
"title": "Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85751",
"datePublished": "2026-09-21T15:39:24.774Z",
"dateReserved": "2026-09-04T14:50:16.721Z",
"dateUpdated": "2026-09-21T17:56:14.484Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49217 (GCVE-0-2026-49217)
Vulnerability from cvelistv5 – Published: 2026-08-20 22:01 – Updated: 2026-08-25 15:33
VLAI
EPSS
VEX
Title
Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions
Summary
Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is enabled. Upgrade to Mailu 2024.06.52 to receive a patch or, as a workaround, turn the REST API off.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 15:33 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/Mailu/Mailu/security/advisorie… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49217",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T15:33:13.726822Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T15:33:28.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Mailu",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003c 2024.06.52"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is enabled. Upgrade to Mailu 2024.06.52 to receive a patch or, as a workaround, turn the REST API off."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T22:01:41.588Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2w8v-6xr5-g9gh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2w8v-6xr5-g9gh"
}
],
"source": {
"advisory": "GHSA-2w8v-6xr5-g9gh",
"discovery": "UNKNOWN"
},
"title": "Mailu missing authentication on PATCH /api/v1/token/\u003cid\u003e, which allows unauthenticated removal of IP restrictions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49217",
"datePublished": "2026-08-20T22:01:41.588Z",
"dateReserved": "2026-05-28T03:42:34.341Z",
"dateUpdated": "2026-08-25T15:33:28.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2020-5239 (GCVE-0-2020-5239)
Vulnerability from cvelistv5 – Published: 2020-02-13 00:20 – Updated: 2024-08-04 08:22
VLAI
EPSS
VEX
Title
Unspecified vulnerability in the fetchmail script in Mailu
Summary
In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afterwards, see https://github.com/Mailu/Mailu/issues/1354
Severity
8.7 (High)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Mailu/Mailu/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/Mailu/Mailu/issues/1354 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:22:09.018Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Mailu/Mailu/issues/1354"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Mailu",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afterwards, see https://github.com/Mailu/Mailu/issues/1354"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-13T00:20:13.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/issues/1354"
}
],
"source": {
"advisory": "GHSA-2467-p5gv-58q6",
"discovery": "UNKNOWN"
},
"title": "Unspecified vulnerability in the fetchmail script in Mailu",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2020-5239",
"STATE": "PUBLIC",
"TITLE": "Unspecified vulnerability in the fetchmail script in Mailu"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Mailu",
"version": {
"version_data": [
{
"version_value": "\u003c 1.7"
}
]
}
}
]
},
"vendor_name": "Mailu"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afterwards, see https://github.com/Mailu/Mailu/issues/1354"
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-863: Incorrect Authorization"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6",
"refsource": "CONFIRM",
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6"
},
{
"name": "https://github.com/Mailu/Mailu/issues/1354",
"refsource": "MISC",
"url": "https://github.com/Mailu/Mailu/issues/1354"
}
]
},
"source": {
"advisory": "GHSA-2467-p5gv-58q6",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2020-5239",
"datePublished": "2020-02-13T00:20:13.000Z",
"dateReserved": "2020-01-02T00:00:00.000Z",
"dateUpdated": "2024-08-04T08:22:09.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}