CVE-2026-86008: Mailu domain managers can take over higher-privileged accounts
Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must already have a domain manager account. They can then target an administrative account or another domain manager account with greater privileges.
What can a successful attacker do?
A domain manager can reset the targeted account's password or obtain tokens for it. This enables takeover of the higher-privileged account and use of that account's permissions.
How can I determine whether my Mailu deployment is affected?
Deployments using code prior to commit 8577c929b4ade04d3cd4210cf036601abd793556 are affected. The provided information does not identify affected release version numbers.
What remediation is available?
Update to a Mailu version or build that includes commit 8577c929b4ade04d3cd4210cf036601abd793556. The provided information does not describe a workaround if updating cannot be performed immediately.