CVE-2026-104084

Summary

The vulnerability allows attackers to escalate privileges by replaying stale JWT tokens that retain elevated roles like DomainAdmin or SysAdmin, even after users have been demoted. This occurs because the system doesn't revalidate user roles when refreshing tokens.

Exploitability

Exploitation requires capturing a refresh token before a user demotion and replaying it within the token's natural expiry window, making it moderately difficult but possible with persistent monitoring.

Blast radius

The impact could be significant as attackers can gain full administrative access to email accounts and potentially compromise entire domains through elevated privilege token replay.

Detection

Monitor for POST /api/v1/auth/refresh-token API calls with tokens that show role claims inconsistent with the current user's assigned roles in the system logs.

Prioritized remediation

Upgrade to SmarterMail build 9777 or later to fix the JWT role validation issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.