Authorization Bypass in MailEnable Enterprise Premium by MailEnable

CVE-2026-44400

What is CVE-2026-44400?

MailEnable Enterprise Premium versions 10.55 and earlier are susceptible to an improper authorization vulnerability in the WebAdmin mobile portal. This flaw allows attackers to bypass authentication by exploiting AuthenticationToken cookies that are issued to low-privileged users. By leveraging the PersistentLogin parameter, adversaries can obtain a token from the WebMail login endpoint and use it to gain unauthorized access to the WebAdmin portal. This could enable them to execute highly privileged administrative actions without proper authorization, posing a significant security threat to affected systems.

References