{"id":"CVE-2026-86008","aliases":["EUVD-2026-102921","GHSA-9pv5-rm76-3qwj"],"status":"published","title":"Mailu domain managers can take over higher-privileged accounts","description":"Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00314,"percentile":0.24465,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269","CWE-285"],"published":"2026-10-16T16:16:51Z","modified":"2026-10-28T02:31:05Z","products":[{"vendor":"mailu","product":"mailu"}],"references":[{"url":"https://github.com/Mailu/Mailu/security/advisories/GHSA-9pv5-rm76-3qwj","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/Mailu/Mailu/issues/2685","tags":["x_refsource_MISC","report"]},{"url":"https://github.com/Mailu/Mailu/pull/4050","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/Mailu/Mailu/commit/8577c929b4ade04d3cd4210cf036601abd793556","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86008.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86008","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-86008","title":"Mailu domain managers can take over higher-privileged accounts","description":"Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.","status":"published","published":"2026-10-16T16:16:51.097Z","modified":"2026-10-16T16:53:59.579Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-285","CWE-269"],"updated_at":"2026-11-02T13:49:42.666099Z"}],"euvd":[{"id":"EUVD-2026-102921","description":"Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.","status":"published","published":"2026-10-16T16:16:51Z","modified":"2026-10-16T16:53:59Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:00:04.71095Z"}],"nvd":[{"id":"CVE-2026-86008","description":"Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.","status":"published","published":"2026-10-16T17:17:51.753Z","modified":"2026-10-16T17:17:51.883Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269","CWE-285"],"updated_at":"2026-11-02T14:13:00.123071Z"}],"osv":[{"id":"CVE-2026-86008","title":"Mailu domain managers can take over higher-privileged accounts","description":"Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.","status":"published","published":"2026-10-16T16:16:51.097Z","modified":"2026-10-28T02:31:05.33601078Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269","CWE-285"],"updated_at":"2026-11-02T15:45:18.825071Z"}]}}