CVE-2026-104084 SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token
Attackers can replay stale refresh tokens to regain elevated administrative privileges after account demotion in SmarterMail.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104084?
CVE-2026-104084 is a high-severity vulnerability in Smartertools Smartermail, published on 9 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token issued before an administrator demotion, or a demoted user whose session was not actively polling at the time of demotion, can replay the stale token to obtain a new access token retaining the higher-privilege role (such as DomainAdmin or SysAdmin) until natural token expiry.
Weakness: CWE-613
Which versions are affected by CVE-2026-104084?
How do I fix CVE-2026-104084?
No fix has been published for CVE-2026-104084 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-104084 being exploited?
There is no known exploitation of CVE-2026-104084 in the wild and no public exploit code.
Sources
Also known as GHSA-3wv9-x54m-xfch.