CVE-2026-85749

Name of the Vulnerable Software and Affected Versions MailWatch for MailScanner versions prior to 1.2.27

Description Authenticated users with U/user, D/domain-admin, or H/host roles can release or permanently delete quarantined emails belonging to other users or domains. This occurs because the endpoint 'mailscanner/quarantine action.php' calls the quarantine list items() function in 'mailscanner/functions.php', which retrieves data from the maillog using a supplied id without applying the required per-role global filter. Since message identifiers are enumerable and ownership is not verified, a low-privilege user can trigger the quarantine release() or quarantine delete() functions for messages they do not own.

Recommendations Update to version 1.2.27.