CVE-2026-49217: Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions
Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is enabled. Upgrade to Mailu 2024.06.52 to receive a patch or, as a workaround, turn the REST API off.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mailuto a version that resolves this vulnerability.Fixed in 2024.06.52 - Configuration
Turn the REST API off as a workaround (prior to version 2024.06.52) to prevent unauthenticated removal of IP restrictions or updating the comment field via PATCH /api/v1/token/<id>.
Mailu admin REST API REST API enabled = false
Event History
Frequently Asked Questions
Who is exposed to this issue?
Mailu deployments running versions before 2024.06.52 are exposed if the admin REST API is enabled. An attacker can act remotely without authentication, but must target an existing user token.
What can an attacker change through the vulnerable endpoint?
An unauthenticated attacker can remove IP restrictions from an existing user token or modify that token's comment field. The issue affects PATCH requests to /api/v1/token/<id>.
What should be done if upgrading is not immediately possible?
Turn off the Mailu REST API as a workaround. Upgrading to Mailu 2024.06.52 provides the patch.