CVE-2026-85749: MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail
MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any authenticated MailWatch user, including the U/user, D/domain-admin, and H/host roles, can release to inbox or permanently delete the quarantined mail of any other user or domain by supplying an arbitrary message id to mailscanner/quarantineaction.php. The action path calls quarantinelistitems() in mailscanner/functions.php, which selects from maillog by the supplied identifier without the per-role globalfilter applied by listing and read views. The action requires a valid session and CSRF token, but the caller can submit a token from the caller's own session; ownership of the requested message is never checked. Message identifiers are enumerable, allowing a low-privilege user to invoke quarantinerelease() or quarantinedelete() for other users' or domains' quarantined messages, force-delivering mail held by the quarantine or permanently deleting it. This issue is fixed in version 1.2.27.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MailWatch for MailScannerto a version that resolves this vulnerability.Fixed in 1.2.27
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated MailWatch user can exploit it, including users with U/user, D/domain-admin, or H/host roles. The attacker needs only a valid session and a CSRF token from their own session.
What access does an attacker need to another user's quarantined message?
No access to the target user's account, domain, or CSRF token is required. An attacker can supply an arbitrary, enumerable message id to the quarantine action endpoint because ownership is not checked.
What is the practical impact?
An authenticated low-privilege user can release another user's or domain's quarantined mail to its inbox, or permanently delete it. This can force delivery of mail that quarantine controls were intended to hold.
Which versions are affected and what is the remediation?
MailWatch versions prior to 1.2.27 are affected. Upgrade to version 1.2.27, which fixes the issue.