CVE-2026-86008 Mailu domain managers can take over higher-privileged accounts
A domain manager can reset passwords or obtain tokens for higher-privileged accounts, allowing account takeover and privilege escalation in Mailu.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86008?
CVE-2026-86008 is a high-severity vulnerability in Mailu, published on 16 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.
Which versions are affected by CVE-2026-86008?
How do I fix CVE-2026-86008?
No fix has been published for CVE-2026-86008 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-86008 being exploited?
There is no known exploitation of CVE-2026-86008 in the wild and no public exploit code.
Sources
Also known as GHSA-9pv5-rm76-3qwj.