Executive brief
Mailu is a mail server application delivered as Docker images. A missing authentication check in its admin REST API allows unauthenticated attackers to modify user authentication tokens—specifically removing IP restrictions or changing token comments. This could enable attackers to bypass security controls and gain unauthorized access to user accounts if the REST API is accessible.
Technical details
The vulnerability is a missing authentication check (CWE-306) in the PATCH /api/v1/token/<id> endpoint of the Mailu admin REST API. An unauthenticated attacker can exploit this over the network to modify any existing user token by removing IP restrictions or updating comment fields, provided the REST API is enabled. The attack requires no privileges, user interaction, or special preconditions beyond network reachability to the REST API. The fix is available in Mailu version 2024.06.52 and later, or administrators can disable the REST API as a workaround.
Affected products
- Mailu Mailu prior to 2024.06.52
Timeline
- 2026-05-28: disclosed: GHSA advisory published
- 2026-06-52: patched: Patched in Mailu 2024.06.52