PT-2026-79258 · Mailu · Mailu

CVE-2026-49217

·

Published

2026-08-20

·

Updated

2026-08-20

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Mailu versions prior to 2024.06.52
Description A missing authorization check in the admin REST API allows an unauthenticated attacker to remove IP restrictions or update the comment field of an existing user token, provided the REST API is enabled.
Recommendations Upgrade to version 2024.06.52. As a temporary workaround, turn the REST API off.

Exploit

Fix

Missing Authentication

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-49217
GHSA-2W8V-6XR5-G9GH

Affected Products

Mailu