CVE-2026-104084

Name of the Vulnerable Software and Affected Versions SmarterMail versions prior to build 9777

Description An issue exists where JSON Web Tokens (JWT) for access and refresh purposes embed a role claim at the time of issuance. This claim is not revalidated against the account's current role when redeemed via the 'POST /api/v1/auth/refresh-token' endpoint. Consequently, a user who has been demoted from an administrative role, or an attacker who captures a refresh token issued before such a demotion, can replay the stale token to obtain a new access token that retains elevated privileges, such as DomainAdmin or SysAdmin, until the token expires naturally.

Recommendations Update to build 9777 or later.