Mailu EUVD-2026-102922

Requires a multi-tenant Mailu deployment hosting more than one domain, and the attacker must already hold a domain-manager (administrative) role over at least one hosted domain - confirmed by PR:H and the description's 'domain managers'/'domain administrator' wording. The specific trigger is enabling the allow_spoofing user permission, which pre-patch was not scoped to the manager's own domain, letting the lookup in core/admin/mailu/internal/views/postfix.py (postfix_sender_login) authorize that user as a sender for arbitrary hosted domains. Limiting factors: not exploitable on single-tenant/self-hosted instances with no untrusted domain managers; cross-domain spoofing only reaches other domains hosted on the same Mailu instance (not arbitrary external domains); no unauthenticated or end-user-level path exists.

This is a genuine but access-gated authorization flaw (CWE-285) rather than a mass-exploitation threat. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N, 8.2) is internally consistent with the description: PR:H confirms the attacker must already hold a privileged domain-manager role, AV:N reflects exploitation through the web admin interface, and the impact is purely integrity (VI:H/SI:H) - no confidentiality or availability effect, matching a spoofing/forgery outcome. No EPSS score, SSVC decision, or KEV entry was provided, so there is no signal of active or automatable exploitation. There is no standalone proof-of-concept exploit in the input - only the upstream patch (PR #4072) and a regression test, which demonstrate the mechanism but are fix artifacts, not weaponized exploit code. The high 8.2 score is driven by the strong integrity impact (forged DKIM/SPF-authenticated mail), but the PR:H precondition and the requirement for a multi-tenant hosted-domain deployment sharply narrow the realistic attacker population to insiders/tenants on shared Mailu instances. Verdict: a real priority for multi-tenant mail hosters, but low urgency for single-tenant/self-hosted operators where no untrusted domain manager exists.

On a Mailu instance hosting multiple customer domains, a malicious or compromised domain manager for attacker.com enables the allow_spoofing permission on a user they control, then uses it to send mail as a sender at victim.com, a domain they do not manage. Because the sender/login lookup was not scoped to the attacker's own domain, Mailu signs and authorizes the message so it passes DKIM/SPF for victim.com, enabling convincing phishing. No public exploit is identified at time of analysis, though the upstream patch and regression test fully disclose the mechanism.