Design-Level Authorization Flaw in N-able Mail Assure Affects Multiple Tenants

CVE-2025-68624

What is CVE-2025-68624?

The N-able Mail Assure service contains a design-level vulnerability that enables unauthorized dispatch of emails by authenticated SMTP users. This flaw permits users to utilize MAIL FROM addresses belonging to other tenants, effectively allowing one tenant to impersonate the domains of others. During SMTP authentication, the system fails to enforce strict sender-domain binding according to tenant accounts, leading to potential misuse where attacker-generated messages can pass SPF and DMARC validations. N-able asserts that this design is intentional to facilitate its shared SMTP relay architecture.

References