A domain manager with lower privileges can reset passwords or acquire authentication tokens for higher‑privileged administrative accounts or other domain managers. This flaw is an authorization failure (CWE-269, CWE-285) allowing the attacker to assume the identity of a more powerful account, violating privilege boundaries and enabling misuse of sensitive data and control over mail server functions.

Mailu, the Docker‑based mail server, is affected in all deployments using images dated before commit 8577c929b4ade04d3cd4210cf036601abd793556. Any installation that has not upgraded to a newer image containing this fix remains vulnerable.

The CVSS score is 7.2, indicating a high‑severity vulnerability. The EPSS score is unavailable, so exploitation probability is unclear, and the vulnerability is not listed in CISA KEV. The attack requires an authenticated domain manager role; it is therefore an internal, authenticated attack vector that permits an attacker with enough privileges to effectively hijack higher‑level accounts. The impact is limited to systems where domain manager privileges exist and the attacker can use the elevated account to read, send, or delete sensitive information, or reconfigure server settings. The scope is confined to accounts with issuer equality and the compromise does not directly expose the underlying host beyond the Mailu web interface.