Mailu CVE-2026-49217

The Mailu admin REST API must be explicitly enabled in the Mailu configuration - it is not the default state, so default Mailu installations are not affected. The attacker requires network-level reachability to the REST API endpoint; no authentication or credentials are needed (PR:N per CVSS vector). A valid user token must already exist in the system for the attacker to target; token identifiers may need to be known or enumerated. Exploitation is bounded to two specific actions: removing IP address restrictions from an existing token, and updating a token's comment field. It does not grant the ability to create new tokens, read credentials, or directly access mail data. The indirect escalation risk is that a previously IP-restricted token becomes usable from arbitrary IP addresses after exploitation.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, score 7.5) accurately characterizes the attack profile: network-reachable, zero authentication, trivial complexity, and high integrity impact. The integrity impact is meaningful because removing IP allowlists from existing tokens can enable subsequent abuse of those tokens from arbitrary locations, potentially broadening an attacker's foothold into admin-level mail server operations. EPSS data was not provided in the intelligence, so probabilistic exploitation likelihood cannot be quantified. The absence of a CISA KEV listing and no identified public exploit code moderates immediate urgency. The decisive risk-limiting factor is the non-default deployment condition: the REST API must be explicitly enabled by the operator. Environments with the API disabled - the default - are entirely unaffected, substantially reducing the realistic exposed population despite the high CVSS score.

An attacker with network access to a Mailu instance where the REST API is enabled sends an unauthenticated HTTP request to the token modification endpoint, targeting a user token by its identifier. The attacker removes the IP allowlist restriction from that token; the server completes the action without requiring credentials. The attacker then uses the now-unrestricted token from any IP address to interact with Mailu's admin API with the privileges that token carries. No public exploit code has been identified at time of analysis, but the attack requires only standard HTTP tooling given the trivial CVSS vector.