Authorization Bypass in Mailu Mail Server by Mailu
CVE-2026-49217

7.5HIGH

Key Information:

Vendor

Mailu

Status
Mailu
Vendor
CVE Published:
20 August 2026

What is CVE-2026-49217?

Mailu, a popular mail server solution utilizing Docker images, is susceptible to an authorization bypass vulnerability due to a missing authorization check in its admin REST API. This flaw allows unauthenticated attackers to manipulate user data by removing IP restrictions or altering comment fields associated with user tokens, provided the REST API feature is activated. Users are advised to upgrade to version 2024.06.52 to mitigate this risk or disable the REST API as a temporary measure.

Affected Version(s)

Mailu < 2024.06.52

References

https://github.com/Mailu/Mailu/security/advisories/GHSA-2...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.