Read the docs
TI-2026-75366 Aliases CVE-2026-86008

Mailu domain managers can take over higher-privileged accounts

Priority LOW 33CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation, Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269 and CWE-285.

Summary

Mailu, a mail server distributed as a set of Docker images, is affected prior to commit 8577c929b4ade04d3cd4210cf036601abd793556. An authorization failure (CWE-285) lets a domain manager target an administrative account or another domain manager with greater privileges. A domain manager can reset passwords or obtain tokens for that account and take it over, exercising its permissions.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00314 24th percentileScored 2026-11-07
Fix Fixed Mailu (Mailu): 8577c929b4ade04d3cd4210cf036601abd793556

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MailuMailubefore 8577c929b4ade04d3cd4210cf036601abd7935568577c929b4ade04d3cd4210cf036601abd793556Patch availableCNA
  • Mailu VendorMailu Affected before 8577c929b4ade04d3cd4210cf036601abd793556 Fixed in 8577c929b4ade04d3cd4210cf036601abd793556 Patch available CNA

Remediation

The sources list no fixed version for Mailu. The fix is commit 8577c929b4ade04d3cd4210cf036601abd793556.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Mailu (Mailu) Fixed in 8577c929b4ade04d3cd4210cf036601abd793556

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-86008
  2. 2026-10-16 CISA SSVC decision points changed
  3. 2026-10-16 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2026-75367 Mailu lets domain managers enable spoofing on other hosted domains CVSS 4.0HIGH 8.2
  • TI-2026-58835 Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust CVSS 3.1CRITICAL 9.8
  • TI-2020-04295 Unspecified vulnerability in the fetchmail script in Mailu CVSS 3.1HIGH 8.8
  • TI-2026-36418 Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences