ZDI-CAN-29137: ZDI-26-811: MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability

Published Oct 27, 2026

This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2026-114552.

Affected Software

1 affected component

MailEnable MailEnable

Event History

Oct 27, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

Who can exploit this issue?

A remote attacker who can authenticate to an affected MailEnable installation can exploit the vulnerability. The available information does not identify any unauthenticated attack path.

What is the impact of successful exploitation?

Successful exploitation can disclose sensitive information through XML external entity processing. The vulnerability has a CVSS rating of 6.5.

ZDI-CAN-29137: ZDI-26-811: MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?