CVE-2026-49217

Received Received - Intake

Unauthenticated IP Restriction Removal in Mailu Admin API

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is enabled. Upgrade to Mailu 2024.06.52 to receive a patch or, as a workaround, turn the REST API off.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-49217

Affected Vendors & Products

Vendor	Product	Version / Range
mailu	mailu	to 2024.06.52 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability in Mailu versions before 2024.06.52 allows unauthenticated attackers to bypass IP restrictions or modify the comment field of any user token via the admin REST API. The issue stems from a missing authorization check in the API.

Detection Guidance

Check if the Mailu admin REST API is enabled. Inspect Docker logs for unauthorized API access attempts or unusual token modifications. Verify user tokens for unexpected changes in IP restrictions or comments.

Impact Analysis

An attacker could exploit this to remove IP restrictions, potentially allowing unauthorized access to restricted functions or data. They could also alter token comments, which might lead to confusion or further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected Mailu versions may face compliance violations and potential penalties.

Mitigation Strategies

Upgrade Mailu to version 2024.06.52 or later. If upgrading is not possible, disable the Mailu admin REST API immediately to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-49217. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70