Read the docs
TI-2026-70084 Aliases CVE-2026-104084GHSA-3wv9-x54m-xfch

Stale JWT role claim allows privilege escalation in SmarterMail

Priority LOW 39CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-613.

Summary

SmarterMail before Build 9777 does not revalidate the role claim embedded in JWT access and refresh tokens against the account's current role. An attacker who captures a refresh token issued before an administrator demotion, or a demoted user whose session was not actively polling at the time of demotion, can replay the stale token at POST /api/v1/auth/refresh-token to obtain a new access token that keeps the higher privilege role until the token expires. The flaw is classified as CWE-613 (Insufficient Session Expiration) and has a CVSS 4.0 base score of 8.7.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token issued before an administrator demotion, or a demoted user whose session was not actively polling at the time of demotion, can replay the stale token to obtain a new access token retaining the higher-privilege role (such as DomainAdmin or SysAdmin) until natural token expiry.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00311 24th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Smartermail (Smartertools): Build 9777

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SmarterToolsSmartermailbefore Build 9777Build 9777Patch availableCNA
  • Smartermail VendorSmarterTools Affected before Build 9777 Fixed in Build 9777 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:smartertools:smartermail:*:*:*:*:*:*:*:*——SmarterTools
  • cpe:2.3:a:smartertools:smartermail:*:*:*:*:*:*:*:* Versions — — ·SmarterTools

Remediation

Update Smartertools SmarterMail to Build 9777 or later. The sources list no fixed version for SmarterMail before that build. CISA has not added this vulnerability to its Known Exploited Vulnerabilities catalog.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Smartermail (Smartertools) Fixed in Build 9777

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Smartertools Smartermail Build 9777

    3 records Highest priority Priority HIGH 1 HIGH, 2 LOW

    Other records, highest priority first

    • TI-2026-70082 Code injection in SmarterMail Volume Mount allows code executionPriority HIGH 72
    • TI-2026-70083 Stored mutation XSS in SmarterMail via MathML foreign contentPriority LOW 24
    Show all 3 records →

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-104084
  2. 2026-10-12 1 new reference · CNA
  3. 2026-10-12 Alias added: GHSA-3wv9-x54m-xfch

References

Exploit 1

Patch 1

  • TI-2025-32755 Upload arbitrary files in SmarterTools SmarterMail KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-19690 SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API KEVCVSS 4.0CRITICAL 9.3
  • TI-2026-19133 SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API KEVCVSS 4.0CRITICAL 9.3
  • TI-2019-05110 SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. CVSS 3.0CRITICAL 9.8
  • TI-2026-70082 Code injection in SmarterMail Volume Mount allows code execution CVSS 4.0HIGH 8.6
  • TI-2020-19061 SmarterTools SmarterTrack 7922 -Information Disclosure CVSS 4.0MEDIUM 6.9
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences