Mailu CVE-2026-86008

Exploitation requires the attacker to hold an authenticated Mailu domain-manager role (not global admin) over at least one domain. The privileged victim - a global admin or a manager of a different domain - must own a mailbox/account within a domain the attacker manages; this is the specific trigger condition because the vulnerable authorization in access.py (domain_admin and owner decorators covering user_edit, user_password, and token_create) checks only whether the target's domain is in the attacker's managed domains and performs no rank comparison. Limiting factors: the attacker needs valid domain-manager credentials, the target must have a mailbox in the managed domain, and the instance must run a version prior to commit 8577c929b4ade04d3cd4210cf036601abd793556; single-tenant installs with no delegated domain managers are effectively not exposed.

This is an authenticated privilege-escalation flaw (CWE-285, Improper Authorization) rated CVSS 7.2. The provided vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H indicates network reachability and low complexity, but critically requires PR:H - the attacker must already be an authenticated domain manager, which materially lowers real-world risk versus an unauthenticated RCE. Impact is severe once the precondition is met: full takeover of a global admin or higher-privileged domain manager (C:H/I:H/A:H). No EPSS score, CISA KEV entry, or POC flag was supplied in the input, so exploitation probability cannot be quantified and there is no public exploit identified at time of analysis; however, the fixing PR #4050 ships regression tests that explicitly demonstrate the vulnerable request paths (an unfixed instance returns HTTP 200 instead of 403 for /user/password/, /user/edit/, and /token/create/ against a global admin), so the exploitation mechanics are fully disclosed and trivially reproducible by anyone with domain-manager access. Net assessment: a genuine high-impact escalation for multi-tenant Mailu deployments where domain managers are semi-trusted, but not an internet-wide mass-exploitation priority because it is gated behind existing privileged credentials and the victim owning a mailbox in the attacker's domain. The one signal worth verifying is whether PR:H is appropriate - a 'domain manager' could arguably be scored PR:L (a lower-tier delegated role), which would raise the base score; this does not change the authenticated nature of the attack.

A semi-trusted domain manager in a multi-tenant Mailu instance notices that a global administrator (or a manager of another domain) owns a mailbox within a domain the attacker manages. The attacker invokes the admin UI's password-reset or API-token-creation function against that mailbox; because authorization checks only the target's domain and omits a rank check, the action succeeds and the attacker captures credentials/token for the higher-privileged account. No public exploit is identified, but the fix PR's regression tests disclose the exact vulnerable endpoints.