SmarterMail before build 9777 issues JSON Web Tokens that embed the user’s role at issuance and does not re‑validate the role when the token is refreshed via the POST /api/v1/auth/refresh-token endpoint. Stale tokens that were issued before an account’s role was lowered can therefore be replayed to obtain a new access token that still contains the higher‑privilege role, such as DomainAdmin or SysAdmin, until the token naturally expires. This flaw permits an attacker who can capture a suitable refresh token to elevate privileges within the application without any additional action.

All installations of SmarterMail produced by Smartertools that are running any build prior to 9777 are affected. No specific release numbers beyond the threshold are enumerated in the advisory, so all earlier builds are vulnerable.

The CVSS score of 8.7 classifies the flaw as high. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to possess a valid stale refresh token that was issued before a role change. The attacker can then submit that token to the refresh endpoint to receive an access token that still claims the higher‑privilege role. The window of opportunity lasts until the token expires, but the flaw does not provide denial of service or code execution capabilities.