Live › vulnerability › CVE-2026-85749
Go to dashboardMailWatch for MailScanner lets any logged-in user, including plain user and domain-admin roles, pass an arbitrary message ID to the quarantine action, skipping the per-role ownership filter. An attacker can force-deliver or permanently delete quarantined mail belonging to other users or domains.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 23:35 UTC. All times on this page are UTC.
Sites running MailWatch for MailScanner before where more than one user or domain has accounts that can reach the quarantine views. Single-user installs with only administrator accounts face less exposure from other users, but the flaw still lets any authenticated account act on quarantined mail. unknown for whether the sources list other affected deployment types.
1.2.27No product ranges from the sources yet.
1.2.27mailscanner/quarantine_action.php in the MailWatch install and confirm it is present1.2.27 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any authenticated MailWatch user, including the U/user, D/domain-admin, and H/host roles, can release to inbox or permanently delete the quarantined mail of any other user or domain by supplying an arbitrary message id to mailscanner/quarantine_action.php. The action path calls quarantine_list_items() in mailscanner/functions.php, which selects from maillog by the supplied identifier without the per-role global_filter applied by listing and read views. The action requires a valid session and CSRF token, but the caller can submit a token from the caller's own session; ownership of the requested message is never checked. Message identifiers are enumerable, allowing a low-privilege user to invoke quarantine_release() or quarantine_delete() for other users' or domains' quarantined messages, force-delivering mail held by the quarantine or permanently deleting it. This issue is fixed in version 1.2.27.
This page as .md · .json · in your agent: get_signal("CVE-2026-85749")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.