CVE-2026-85749 MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-85749?
CVE-2026-85749 is a high-severity vulnerability in MailWatch, published on 28 Oct 2026.
Official description
MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any authenticated MailWatch user, including the U/user, D/domain-admin, and H/host roles, can release to inbox or permanently delete the quarantined mail of any other user or domain by supplying an arbitrary message `id` to `mailscanner/quarantine_action.php`. The action path calls `quarantine_list_items()` in `mailscanner/functions.php`, which selects from `maillog` by the supplied identifier without the per-role `global_filter` applied by listing and read views. The action requires a valid session and CSRF token, but the caller can submit a token from the caller's own session; ownership of the requested message is never checked. Message identifiers are enumerable, allowing a low-privilege user to invoke `quarantine_release()` or `quarantine_delete()` for other users' or domains' quarantined messages, force-delivering mail held by the quarantine or permanently deleting it. This issue is fixed in version 1.2.27.
Which versions are affected by CVE-2026-85749?
How do I fix CVE-2026-85749?
No fix has been published for CVE-2026-85749 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-85749 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-85749 exists.
Sources
Also known as GHSA-w7v5-7g6w-87r4.