CVE-2026-86008
Deferred Deferred - Pending Action

Authorization Bypass in Mailu Docker Images

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-86008
EUVD
EUVD-2026-102921

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Mailu Mailu < 8577c929b4ade04d3cd4210cf036601abd793556

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86008 is a privilege escalation vulnerability in the Mailu email server software. A domain manager can exploit insufficient access controls to take over higher-privileged accounts, such as global administrators or managers of other domains. The issue occurs because the system only checks domain ownership without verifying the actor's rank or privileges.

Detection Guidance

Check Mailu version with: docker inspect mailu_core | grep Image. If version is before 8577c929b4ade04d3cd4210cf036601abd793556, the system is vulnerable. Review logs for unauthorized password resets or token creation by domain managers.

Impact Analysis

An attacker with domain manager access could reset passwords or obtain tokens for higher-privileged accounts, allowing them to take over those accounts and exercise their permissions. This could lead to unauthorized access, data breaches, or full control of the mail server.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected Mailu versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade Mailu to commit 8577c929b4ade04d3cd4210cf036601abd793556 or later. Review and restrict domain manager privileges. Audit accounts for unauthorized changes. Monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86008. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart