Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by Mailu
CVE-2026-85751 (GCVE-0-2026-85751)
Vulnerability from nvd – Published: 2026-09-21 15:39 – Updated: 2026-09-21 17:56
VLAI
EPSS
VEX
Title
Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust
Summary
Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 17:56 UTC
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/Mailu/Mailu/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/Mailu/Mailu/pull/4070 | x_refsource_MISC |
| https://github.com/Mailu/Mailu/pull/4071 | x_refsource_MISC |
| https://github.com/Mailu/Mailu/commit/dffa97cbd88… | x_refsource_MISC |
| https://github.com/Mailu/Mailu/commit/ff4003d0457… | x_refsource_MISC |
| https://github.com/Mailu/Mailu/releases/tag/2024.06.55 | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mailu | Mailu |
Affected:
>= 2.0.0, < 2024.06.55
|
|
| Mailu | helm-charts |
Affected:
< 2.7.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85751",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T17:56:04.999383Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T17:56:14.484Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Mailu",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 2024.06.55"
}
]
},
{
"product": "helm-charts",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003c 2.7.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290: Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-807",
"description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:39:24.774Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Mailu/Mailu/security/advisories/GHSA-rfhj-4wcq-74xg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-rfhj-4wcq-74xg"
},
{
"name": "https://github.com/Mailu/Mailu/pull/4070",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/pull/4070"
},
{
"name": "https://github.com/Mailu/Mailu/pull/4071",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/pull/4071"
},
{
"name": "https://github.com/Mailu/Mailu/commit/dffa97cbd889ab208246372ce9c86e99abb27ae9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/commit/dffa97cbd889ab208246372ce9c86e99abb27ae9"
},
{
"name": "https://github.com/Mailu/Mailu/commit/ff4003d045753013470945336448dbd790cac778",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/commit/ff4003d045753013470945336448dbd790cac778"
},
{
"name": "https://github.com/Mailu/Mailu/releases/tag/2024.06.55",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/releases/tag/2024.06.55"
}
],
"source": {
"advisory": "GHSA-rfhj-4wcq-74xg",
"discovery": "UNKNOWN"
},
"title": "Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85751",
"datePublished": "2026-09-21T15:39:24.774Z",
"dateReserved": "2026-09-04T14:50:16.721Z",
"dateUpdated": "2026-09-21T17:56:14.484Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49217 (GCVE-0-2026-49217)
Vulnerability from nvd – Published: 2026-08-20 22:01 – Updated: 2026-08-25 15:33
VLAI
EPSS
VEX
Title
Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions
Summary
Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is enabled. Upgrade to Mailu 2024.06.52 to receive a patch or, as a workaround, turn the REST API off.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 15:33 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/Mailu/Mailu/security/advisorie… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49217",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T15:33:13.726822Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T15:33:28.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Mailu",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003c 2024.06.52"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is enabled. Upgrade to Mailu 2024.06.52 to receive a patch or, as a workaround, turn the REST API off."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T22:01:41.588Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2w8v-6xr5-g9gh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2w8v-6xr5-g9gh"
}
],
"source": {
"advisory": "GHSA-2w8v-6xr5-g9gh",
"discovery": "UNKNOWN"
},
"title": "Mailu missing authentication on PATCH /api/v1/token/\u003cid\u003e, which allows unauthenticated removal of IP restrictions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49217",
"datePublished": "2026-08-20T22:01:41.588Z",
"dateReserved": "2026-05-28T03:42:34.341Z",
"dateUpdated": "2026-08-25T15:33:28.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2020-5239 (GCVE-0-2020-5239)
Vulnerability from nvd – Published: 2020-02-13 00:20 – Updated: 2024-08-04 08:22
VLAI
EPSS
VEX
Title
Unspecified vulnerability in the fetchmail script in Mailu
Summary
In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afterwards, see https://github.com/Mailu/Mailu/issues/1354
Severity
8.7 (High)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Mailu/Mailu/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/Mailu/Mailu/issues/1354 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:22:09.018Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Mailu/Mailu/issues/1354"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Mailu",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afterwards, see https://github.com/Mailu/Mailu/issues/1354"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-13T00:20:13.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/issues/1354"
}
],
"source": {
"advisory": "GHSA-2467-p5gv-58q6",
"discovery": "UNKNOWN"
},
"title": "Unspecified vulnerability in the fetchmail script in Mailu",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2020-5239",
"STATE": "PUBLIC",
"TITLE": "Unspecified vulnerability in the fetchmail script in Mailu"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Mailu",
"version": {
"version_data": [
{
"version_value": "\u003c 1.7"
}
]
}
}
]
},
"vendor_name": "Mailu"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afterwards, see https://github.com/Mailu/Mailu/issues/1354"
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-863: Incorrect Authorization"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6",
"refsource": "CONFIRM",
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6"
},
{
"name": "https://github.com/Mailu/Mailu/issues/1354",
"refsource": "MISC",
"url": "https://github.com/Mailu/Mailu/issues/1354"
}
]
},
"source": {
"advisory": "GHSA-2467-p5gv-58q6",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2020-5239",
"datePublished": "2020-02-13T00:20:13.000Z",
"dateReserved": "2020-01-02T00:00:00.000Z",
"dateUpdated": "2024-08-04T08:22:09.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-85751 (GCVE-0-2026-85751)
Vulnerability from cvelistv5 – Published: 2026-09-21 15:39 – Updated: 2026-09-21 17:56
VLAI
EPSS
VEX
Title
Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust
Summary
Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 17:56 UTC
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/Mailu/Mailu/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/Mailu/Mailu/pull/4070 | x_refsource_MISC |
| https://github.com/Mailu/Mailu/pull/4071 | x_refsource_MISC |
| https://github.com/Mailu/Mailu/commit/dffa97cbd88… | x_refsource_MISC |
| https://github.com/Mailu/Mailu/commit/ff4003d0457… | x_refsource_MISC |
| https://github.com/Mailu/Mailu/releases/tag/2024.06.55 | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mailu | Mailu |
Affected:
>= 2.0.0, < 2024.06.55
|
|
| Mailu | helm-charts |
Affected:
< 2.7.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85751",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T17:56:04.999383Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T17:56:14.484Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Mailu",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 2024.06.55"
}
]
},
{
"product": "helm-charts",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003c 2.7.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290: Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-807",
"description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:39:24.774Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Mailu/Mailu/security/advisories/GHSA-rfhj-4wcq-74xg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-rfhj-4wcq-74xg"
},
{
"name": "https://github.com/Mailu/Mailu/pull/4070",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/pull/4070"
},
{
"name": "https://github.com/Mailu/Mailu/pull/4071",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/pull/4071"
},
{
"name": "https://github.com/Mailu/Mailu/commit/dffa97cbd889ab208246372ce9c86e99abb27ae9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/commit/dffa97cbd889ab208246372ce9c86e99abb27ae9"
},
{
"name": "https://github.com/Mailu/Mailu/commit/ff4003d045753013470945336448dbd790cac778",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/commit/ff4003d045753013470945336448dbd790cac778"
},
{
"name": "https://github.com/Mailu/Mailu/releases/tag/2024.06.55",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/releases/tag/2024.06.55"
}
],
"source": {
"advisory": "GHSA-rfhj-4wcq-74xg",
"discovery": "UNKNOWN"
},
"title": "Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85751",
"datePublished": "2026-09-21T15:39:24.774Z",
"dateReserved": "2026-09-04T14:50:16.721Z",
"dateUpdated": "2026-09-21T17:56:14.484Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49217 (GCVE-0-2026-49217)
Vulnerability from cvelistv5 – Published: 2026-08-20 22:01 – Updated: 2026-08-25 15:33
VLAI
EPSS
VEX
Title
Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions
Summary
Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is enabled. Upgrade to Mailu 2024.06.52 to receive a patch or, as a workaround, turn the REST API off.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 15:33 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/Mailu/Mailu/security/advisorie… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49217",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T15:33:13.726822Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T15:33:28.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Mailu",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003c 2024.06.52"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is enabled. Upgrade to Mailu 2024.06.52 to receive a patch or, as a workaround, turn the REST API off."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T22:01:41.588Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2w8v-6xr5-g9gh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2w8v-6xr5-g9gh"
}
],
"source": {
"advisory": "GHSA-2w8v-6xr5-g9gh",
"discovery": "UNKNOWN"
},
"title": "Mailu missing authentication on PATCH /api/v1/token/\u003cid\u003e, which allows unauthenticated removal of IP restrictions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49217",
"datePublished": "2026-08-20T22:01:41.588Z",
"dateReserved": "2026-05-28T03:42:34.341Z",
"dateUpdated": "2026-08-25T15:33:28.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2020-5239 (GCVE-0-2020-5239)
Vulnerability from cvelistv5 – Published: 2020-02-13 00:20 – Updated: 2024-08-04 08:22
VLAI
EPSS
VEX
Title
Unspecified vulnerability in the fetchmail script in Mailu
Summary
In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afterwards, see https://github.com/Mailu/Mailu/issues/1354
Severity
8.7 (High)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Mailu/Mailu/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/Mailu/Mailu/issues/1354 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:22:09.018Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Mailu/Mailu/issues/1354"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Mailu",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003c 1.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afterwards, see https://github.com/Mailu/Mailu/issues/1354"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-13T00:20:13.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/issues/1354"
}
],
"source": {
"advisory": "GHSA-2467-p5gv-58q6",
"discovery": "UNKNOWN"
},
"title": "Unspecified vulnerability in the fetchmail script in Mailu",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2020-5239",
"STATE": "PUBLIC",
"TITLE": "Unspecified vulnerability in the fetchmail script in Mailu"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Mailu",
"version": {
"version_data": [
{
"version_value": "\u003c 1.7"
}
]
}
}
]
},
"vendor_name": "Mailu"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afterwards, see https://github.com/Mailu/Mailu/issues/1354"
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-863: Incorrect Authorization"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6",
"refsource": "CONFIRM",
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6"
},
{
"name": "https://github.com/Mailu/Mailu/issues/1354",
"refsource": "MISC",
"url": "https://github.com/Mailu/Mailu/issues/1354"
}
]
},
"source": {
"advisory": "GHSA-2467-p5gv-58q6",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2020-5239",
"datePublished": "2020-02-13T00:20:13.000Z",
"dateReserved": "2020-01-02T00:00:00.000Z",
"dateUpdated": "2024-08-04T08:22:09.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}