Description
Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is enabled. Upgrade to Mailu 2024.06.52 to receive a patch or, as a workaround, turn the REST API off.
Published: 2026-08-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Missing authentication on the PATCH /api/v1/token/<id> endpoint allows an unauthenticated attacker to remove any IP restrictions or modify the comment field of existing user tokens in Mailu, a Docker‑based mail server. This is an access‑control weakness (CWE‑306) that can lead to loss of network‑level restrictions, potentially enabling broader internal access or service disruption.

Affected Systems

The affected product is Mailu. Versions earlier than 2024.06.52 are vulnerable; the REST API must be enabled for the issue to be exploitable.

Risk and Exploitability

The CVSS score is 7.5, indicating high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Because the REST API is reachable over the network and no authentication is required, the likelihood of exploitation is moderate to high for exposed deployments. The flaw is most likely to be triggered by a network attacker who can issue the PATCH request, making it a classic unauthenticated access‑control bypass.

Generated by OpenCVE AI on August 21, 2026 at 00:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Mailu to version 2024.06.52 or later to apply the official patch.
  • If an upgrade cannot be performed immediately, disable the REST API to prevent unauthenticated access.
  • After updating or disabling the API, verify that no other endpoints grant token management without authentication and enforce network‑based access controls.

Generated by OpenCVE AI on August 21, 2026 at 00:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Mailu
Mailu mailu
Vendors & Products Mailu
Mailu mailu

Thu, 20 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is enabled. Upgrade to Mailu 2024.06.52 to receive a patch or, as a workaround, turn the REST API off.
Title Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Mailu Mailu
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-25T15:33:28.286Z

Reserved: 2026-05-28T03:42:34.341Z

Link: CVE-2026-49217

cve-icon Vulnrichment

Updated: 2026-08-25T15:33:22.453Z

cve-icon NVD

Status : Received

Published: 2026-08-20T22:17:19.803

Modified: 2026-08-25T16:16:53.740

Link: CVE-2026-49217

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T00:30:07Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function