CVE-2026-86008
7.2HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-269, CWE-285
Impact
A domain manager can take over higher-privileged admin accounts by resetting their passwords or generating auth tokens. The attacker needs existing domain manager credentials on the Mailu instance.
Root cause
Improper authorization checks allow domain managers to target and modify accounts that have higher privilege levels.
Affected systems
Mailu Docker images prior to commit 8577c929b4ade04d3cd4210cf036601abd793556.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Mailu Docker images to a build containing commit 8577c929b4ade04d3cd4210cf036601abd793556 or newer. As an interim mitigation, restrict or revoke domain manager privileges across non-admin users.
$ docker compose pull && docker compose up -dAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.