HIGH 7.5 NVD

CVE-2026-49217

Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthentica

Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is enabled. Upgrade to Mailu 2024.06.52 to receive a patch or, as a workaround, turn the REST API off.

References

https://github.com/Mailu/Mailu/security/advisories/GHSA-2w8v-6xr5-g9gh

Published: 2026-08-20 · Source: NVD · Feed updated: 2026-08-21

This high severity vulnerability with a CVSS score of 7.5 was published on 2026-08-20 via NVD.

vulnfeed aggregates 9909 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.