TI-2020-10161 Aliases CVE-2020-12776 GHSA-chfx-f86m-4vj9

Openfind Mail2000 - Broken Access Control

LOW 33Published 2020-09-01 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Openfind Mail2000 contains Broken Access Control vulnerability, which can be used to execute unauthorized commands after attackers obtain the administrator access token or cookie.

Why it matters now

EPSS 0.00833 57th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Openfind	Mail2000	up to 7.0	—	No fix listed	CNA

Mail2000 VendorOpenfind Affected up to 7.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openfind:mail2000:7.0:::::::*	7.0	Vulnerable	Openfind

cpe:2.3:a:openfind:mail2000:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Openfind

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2020-12776
2026-10-03 Alias added: GHSA-chfx-f86m-4vj9

References

Advisory 1

https://www.twcert.org.tw/tw/cp-132-3897-01d73-1.html

TI-2024-05016 Openfind Mail2000 - OS Command Injection CVSS 3.1HIGH 8.8
TI-2024-06248 Openfind Mail2000 - HttpOnly flag bypass CVSS 3.1MEDIUM 5.8
TI-2024-05015 Openfind Mail2000 - OS Command Injection CVSS 3.1HIGH 7.2
TI-2019-11251 Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting CVSS 3.1MEDIUM 6.1
TI-2019-11252 Openfind MAIL2000 Webmail Post-Auth Cross-Site Scripting CVSS 3.1MEDIUM 6.1
TI-2019-07155 An issue was discovered in Openfind Mail2000 6.0 and 7.0 Webmail. CVSS 3.0MEDIUM 6.1

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences