Description

Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is enabled. Upgrade to Mailu 2024.06.52 to receive a patch or, as a workaround, turn the REST API off.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-20T22:17:19.803Z",
  "pubdate": "2026-08-20T22:17:19.803Z",
  "executiveSummary": "A missing authorization check vulnerability exists within the Mailu admin REST API prior to version 2024.06.52. This security flaw allows unauthenticated remote attackers to interact with user tokens, specifically enabling the removal of IP restrictions or the modification of comment fields associated with any existing user token. The vulnerability introduces significant risk to authentication controls and operational integrity within affected Mailu mail server deployments where the REST API is enabled. Successful exploitation requires network accessibility to the admin REST API endpoint but does not require valid credentials or prior authentication. The primary impact involves unauthorized tampering with security boundaries by stripping IP restriction constraints from critical access tokens, potentially facilitating subsequent unauthorized access vectors. Remediation requires upgrading the Mailu software suite to version 2024.06.52 or alternatively disabling the REST API functionality as an immediate operational workaround.",
  "technicalDetails": "The vulnerability stems from a fundamental design flaw in the Mailu admin REST API involving a missing authorization check within the access control logic governing user token management. Specifically, the affected component fails to validate whether incoming HTTP requests originate from an authenticated and authorized administrative entity before processing update operations on user tokens. The vulnerable functions exposed by the REST API allow external actors to target existing user tokens by identifier. Upon receiving a maliciously crafted request, the application processes instructions to mutate token attributes, explicitly permitting the removal of configured IP restriction lists and the overwriting of administrative comment fields. Because the API endpoints lack proper authentication enforcement, an unauthenticated attacker operating across the network layer can execute HTTP requests to manipulate these token properties. The attack flow proceeds as follows: first, the attacker identifies a target Mailu deployment where the admin REST API is actively enabled; second, the attacker crafts a malicious HTTP request targeting the token management endpoints without supplying valid authentication headers or credentials; third, the vulnerable API processes the request due to the absent authorization checks, executing the state change against the target user token; finally, the security posture of the token is degraded as IP restrictions are stripped away or metadata comments are altered. The affected versions include all Mailu deployments running software versions prior to 2024.06.52. The privilege requirement to execute this attack is effectively zero, as authentication is bypassed entirely by the underlying software flaw. The network exposure is dictated by the accessibility of the Mailu admin REST API interface. The post-exploitation impact centers on the erosion of network-level access controls tied to user tokens, exposing administrative or user functionalities to unauthorized utilization if additional conditions align with the weakened token posture."
}