CVE-2026-49217

Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions

State: Published
Severity: 7.5 High
Published: Aug 20, 2026
Updated: Aug 25, 2026
Reserved: May 28, 2026

Description

Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is enabled. Upgrade to Mailu 2024.06.52 to receive a patch or, as a workaround, turn the REST API off.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	GitHub_M

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
MailuMailu	< 2024.06.52Affected

References

https://github.com/Mailu/Mailu/security/advisories/GHSA-2w8v-6xr5-g9gh

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.