CVE-2019-12926 Missing authorization in n/a
Authenticated users can bypass access controls to perform unauthorized actions and access restricted application areas in MailEnable Enterprise Premium.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-12926?
CVE-2019-12926 is a high-severity missing authorization vulnerability in Mailenable Mailenable, published on 8 Jul 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. As a result, it was possible to perform a number of actions, when logged in as a user, that that user should not have had permission to perform. It was also possible to gain access to areas within the application for which the accounts used were supposed to have insufficient access.
Weakness: CWE-862
Which versions are affected by CVE-2019-12926?
It affects 1 product.
Products include Mailenable Mailenable.
How do I fix CVE-2019-12926?
No fix has been published for CVE-2019-12926 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-12926 being exploited?
There is no known exploitation of CVE-2019-12926 in the wild and no public exploit code.
Other vulnerabilities in Mailenable Mailenable
- CVE-2015-9280 XML external entity in n/a
- CVE-2025-44148 Cross-site scripting in n/a
- CVE-2019-12924 XML external entity in n/a
- CVE-2015-9278 MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB a
- CVE-2015-9277 Path traversal in n/a
Sources
Also known as GHSA-qwh2-6h9r-j729.