Mailu is a containerized mail server that allows administrators to manage multiple hosted domains. The vulnerability lets a domain manager enable DKIM/SPF spoofing for domains that the manager does not actually own. By doing so, the attacker can send emails that appear to be legitimately signed by the victim domain, potentially enabling phishing, brand impersonation, or other mail‑based attacks. This flaw is a form of improper authorization (CWE‑285) combined with privilege escalation (CWE‑863).

Affects all installations of Mailu distributed as Docker images before the commit f05aeb8322e2f61096af6b089d61ba6f40587d96. Any deployment that has not applied the upstream patch or upgraded to a version that incorporates this fix is vulnerable. The flaw is present in the domain‑management interface and configuration logic.

The CVSS score of 8.2 indicates a high severity vulnerability. Because the EPSS score is not publicly available, the current exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authorized domain manager who has legitimate permissions within the mail server’s administrative interface; with those privileges the attacker can manipulate spoofing flags. If an attacker can elevate privileges to a domain‑manager role, they can abuse this flaw to send spoofed mail as any hosted domain.