CVE-2026-86008

7.2 HIGHpublic exploit available

Published 2026-10-16 · Updated 2026-10-16

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-269, CWE-285

Public exploit & PoC references

https://github.com/Mailu/Mailu/commit/8577c929b4ade04d3cd4210cf036601abd793556
https://github.com/Mailu/Mailu/issues/2685
https://github.com/Mailu/Mailu/pull/4050
https://github.com/Mailu/Mailu/security/advisories/GHSA-9pv5-rm76-3qwj

All references

https://github.com/Mailu/Mailu/commit/8577c929b4ade04d3cd4210cf036601abd793556
https://github.com/Mailu/Mailu/issues/2685
https://github.com/Mailu/Mailu/pull/4050
https://github.com/Mailu/Mailu/security/advisories/GHSA-9pv5-rm76-3qwj

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-104955PoC
MEDIUMCVE-2023-54410PoC
HIGHCVE-2024-58390PoC
MEDIUMCVE-2025-14123
HIGHCVE-2025-71421PoC
HIGHCVE-2025-71426PoC
HIGHCVE-2026-10030
HIGHCVE-2026-100578PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.