Mailenable Enterprise Premium
Monthly
Privilege escalation via authorization bypass in MailEnable Enterprise Premium 10.55 and earlier lets a low-privileged WebMail user gain full administrative control of the mail server. An authenticated attacker obtains an AuthenticationToken cookie from the WebMail login endpoint using the PersistentLogin parameter and replays it against the WebAdmin mobile portal, which fails to validate the token's privilege level. There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and the flaw is not in CISA KEV, but the technical impact is total server compromise.
Privilege escalation via authorization bypass in MailEnable Enterprise Premium 10.55 and earlier lets a low-privileged WebMail user gain full administrative control of the mail server. An authenticated attacker obtains an AuthenticationToken cookie from the WebMail login endpoint using the PersistentLogin parameter and replays it against the WebAdmin mobile portal, which fails to validate the token's privilege level. There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and the flaw is not in CISA KEV, but the technical impact is total server compromise.