ZDI-26-995: SmarterTools SmarterMail Missing Authorization Privilege Escalation Vulnerability

Published Nov 13, 2026

Updated

This vulnerability allows remote attackers to escalate privileges on affected installations of SmarterTools SmarterMail. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-126966.

Affected Software

1 affected component

SmarterTools SmarterMail

Event History

Nov 13, 2026

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

Who can exploit this issue?

An attacker must be able to authenticate to an affected SmarterTools SmarterMail installation. The provided information does not identify any additional access or configuration requirements.

What is the potential impact after exploitation?

A remote authenticated attacker can escalate privileges on an affected installation. The advisory assigns a CVSS score of 8.8.

ZDI-26-995: SmarterTools SmarterMail Missing Authorization Privilege Escalation Vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact after exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact after exploitation?