acmailer CVE-2026-70408

Exploitation requires a valid authenticated low-privilege user account on the target acmailer installation, as confirmed by PR:L in the CVSS 4.0 vector. The sub-account creation feature must be accessible to authenticated non-administrator users - if a specific deployment has been configured to restrict this feature exclusively to existing administrators, the attack path is blocked. No victim interaction is required (UI:N), and no special network position beyond normal authenticated access is needed (AV:N, AC:L, AT:N). The primary factor limiting exploitation is the requirement for an existing account: deployments that do not permit self-registration or that limit access to a small, vetted group of trusted users face substantially reduced exposure compared to installations open to arbitrary authenticated parties.

The CVSS 4.0 score of 8.7 accurately reflects the real-world severity: network-reachable exploitation at low complexity, requiring only a standard authenticated user account, with full compromise of the vulnerable system's confidentiality, integrity, and availability. Even a mid-sized municipal IT team in gniezno running acmailer for subscriber communications should treat this as urgent if their deployment accepts accounts from untrusted or self-registered users. No EPSS score was provided in the available intelligence, and the vulnerability is not listed in the CISA KEV catalog, nor is any public proof-of-concept identified - indicating exploitation has not yet been widely observed in the wild. However, the straightforward nature of the flaw (simply assigning an admin flag during sub-account creation) means it requires no sophisticated technical knowledge, making it trivially reproducible by any authenticated user who explores the sub-account management interface. The primary risk limiter is the requirement for a pre-existing low-privilege account.

An attacker with a standard low-privilege acmailer account navigates to the sub-account creation interface and configures a new account with the administrative privilege level selected. The application fails to verify that the creating user is authorized to assign admin-level roles, completes the account creation without restriction, and the attacker then authenticates as the newly minted admin sub-account. From this position, the attacker gains full administrative control over the acmailer installation, including access to the entire subscriber mailing list database, system configuration, and content management functions. No public proof-of-concept code has been identified, though the steps require only basic familiarity with the application's user interface.