CVE-2026-44400: MailEnable Enterprise Premium < 10.55 Authorization Bypass via WebAdmin
MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile portal that allows attackers to bypass authentication checks by reusing AuthenticationToken cookies generated for low-privileged users. Attackers can obtain a token from the WebMail login endpoint using the PersistentLogin parameter and replay it against the WebAdmin portal to perform highly privileged administrative actions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MailEnable Enterprise Premiumto a version that resolves this vulnerability.Fixed in 10.55Patch MailEnable Enterprise Premium < 10.55 Authorization Bypass via WebAdmin
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44400?
CVE-2026-44400 is considered a high severity vulnerability due to its potential for unauthorized access.
How do I fix CVE-2026-44400?
To fix CVE-2026-44400, upgrade MailEnable Enterprise Premium to version 10.56 or later.
What type of vulnerability is CVE-2026-44400?
CVE-2026-44400 is an authorization bypass vulnerability in the WebAdmin mobile portal.
Who is affected by CVE-2026-44400?
Organizations using MailEnable Enterprise Premium versions 10.55 and earlier are affected by CVE-2026-44400.
What can attackers do with CVE-2026-44400?
Attackers can exploit CVE-2026-44400 to bypass authentication checks and gain unauthorized access to the system.