ZDI-26-810: MailEnable Auth Cleartext Storage Information Disclosure Vulnerability
Published Oct 27, 2026
·Updated
This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.9. The following CVEs are assigned: CVE-2026-114551.
Affected Software
1 affected component
MailEnable MailEnable
Event History
Oct 27, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
Does exploiting this issue require valid MailEnable credentials?
No. The vulnerability can be exploited remotely without authentication.
2
What is the impact of successful exploitation?
A remote attacker can disclose sensitive information from an affected MailEnable installation. The advisory identifies the issue as involving cleartext storage of authentication data.