Authorization Failure in Mailu Mail Server Leads to Account Takeover

CVE-2026-86008

What is CVE-2026-86008?

Mailu, a mail server distributed through Docker images, has a vulnerability that allows a domain manager to exploit an authorization failure. This issue arises when a domain manager targets an administrative account or another domain manager with higher privileges, enabling them to reset passwords or obtain access tokens for that account. Consequently, this can lead to unauthorized takeover of higher-privileged accounts, granting access to permissions reserved for those accounts. This vulnerability was addressed in commit 8577c929b4ade04d3cd4210cf036601abd793556, which rectifies the underlying authorization weaknesses.

References