# CVE-2026-86008: Mailu authorization bypass in admin account management

Source: https://junglewise.ai/threats/cve-2026-86008-mailu-is-a-mail-server-distributed-as-a-set-of-docker-images  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-86008 · Severity: high · CVSS 7.2 · Published 2026-10-16

Mailu is a mail server distributed as Docker images with role-based account management. A domain manager (mid-level administrator) can exploit an authorization flaw to reset passwords and generate API tokens for global administrators or other domain managers, enabling account takeover and full compromise of the mail system.

Technologies: [Mailu](https://junglewise.ai/threats/technologies/mailu). Vendors: [Mailu](https://junglewise.ai/threats/vendors/mailu).

## Quick answers

**Is CVE-2026-86008 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86008 being exploited in the wild.

**How severe is CVE-2026-86008?** High severity, with a CVSS score of 7.2, published 16 October 2026.

**Which products and versions are affected?** Mailu prior to commit 8577c929b4ade04d3cd4210cf036601abd793556.

**Is there a fix for CVE-2026-86008?** Yes: fixed in commit 8577c929b4ade04d3cd4210cf036601abd793556. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86008 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-86008?** Check whether you run Mailu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in commit 8577c929b4ade04d3cd4210cf036601abd793556

## Technical details

A broken access control vulnerability in the user and token management decorators allows domain managers to modify accounts that outrank them. Domain managers can invoke password reset and token creation endpoints against global admins or other domain managers who own mailboxes in their managed domain. The vulnerability stems from authorization checks that only validated the target's domain ownership, not privilege level, enabling privilege escalation and account takeover.

## Affected products

- Mailu Mailu prior to commit 8577c929b4ade04d3cd4210cf036601abd793556

## Timeline

- 2026-10-16: disclosed
- 2026-06-28: patched: Fix committed

## References

- [https://github.com/Mailu/Mailu/commit/8577c929b4ade04d3cd4210cf036601abd793556](https://github.com/Mailu/Mailu/commit/8577c929b4ade04d3cd4210cf036601abd793556)
- [https://github.com/Mailu/Mailu/issues/2685](https://github.com/Mailu/Mailu/issues/2685)

## Related threats

- [Mailu domain manager email spoofing authorization bypass](https://junglewise.ai/threats/cve-2026-86009-mailu-is-a-mail-server-distributed-as-a-set-of-docker-images)
- [Mailu mail server authentication bypass via header spoofing](https://junglewise.ai/threats/cve-2026-85751-mailu-is-a-mail-server-distributed-as-a-set-of-docker-images-from)
- [Mailu admin REST API missing authentication in token endpoint](https://junglewise.ai/threats/cve-2026-49217-mailu-admin-rest-api-missing-authentication-in-token-endpoint)