CVE-2026-44400
Improper Authorization in MailEnable WebAdmin Mobile Portal
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mailenable | enterprise_premium | to 10.55 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in MailEnable Enterprise Premium version 10.55 and earlier. It is an improper authorization flaw in the WebAdmin mobile portal that allows attackers to bypass authentication checks.
Attackers can exploit this by reusing AuthenticationToken cookies that were originally generated for low-privileged users. Specifically, they obtain a token from the WebMail login endpoint using the PersistentLogin parameter and then replay this token against the WebAdmin portal.
By doing so, attackers can perform highly privileged administrative actions without proper authorization.
How can this vulnerability impact me? :
This vulnerability can have serious impacts because it allows attackers to bypass authentication and gain administrative access to the WebAdmin portal.
- Attackers can perform highly privileged administrative actions.
- Unauthorized access to administrative functions can lead to data breaches, system manipulation, or disruption of services.
- Since the vulnerability involves replaying authentication tokens, it can be exploited remotely without user interaction.