{"id":"CVE-2026-85749","kind":"vulnerability","aliases":["CVE-2026-85749"],"related":[],"title":"MailWatch: low-privilege users can release or delete other users' quarantined mail","description":"MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any authenticated MailWatch user, including the U/user, D/domain-admin, and H/host roles, can release to inbox or permanently delete the quarantined mail of any other user or domain by supplying an arbitrary message `id` to `mailscanner/quarantine_action.php`. The action path calls `quarantine_list_items()` in `mailscanner/functions.php`, which selects from `maillog` by the supplied identifier without the per-role `global_filter` applied by listing and read views. The action requires a valid session and CSRF token, but the caller can submit a token from the caller's own session; ownership of the requested message is never checked. Message identifiers are enumerable, allowing a low-privilege user to invoke `quarantine_release()` or `quarantine_delete()` for other users' or domains' quarantined messages, force-delivering mail held by the quarantine or permanently deleting it. This issue is fixed in version 1.2.27.","summary":"MailWatch for MailScanner lets any logged-in user, including plain user and domain-admin roles, pass an arbitrary message ID to the quarantine action, skipping the per-role ownership filter. An attacker can force-deliver or permanently delete quarantined mail belonging to other users or domains.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email","mailscanner","mailwatch","package","self-hosted"],"not_affected_if":["version-1.2.27-or-later"],"how_to_check":"- Check the installed MailWatch version and confirm whether it is below `1.2.27`\n- Look for the file `mailscanner/quarantine_action.php` in the MailWatch install and confirm it is present","fix":"- Upgrade MailWatch for MailScanner to `1.2.27` or later","status":"open","published_at":"2026-10-28T23:17:11+00:00","first_seen_at":"2026-10-28T23:35:49+00:00","triaged_at":"2026-10-28T23:36:39+00:00","updated_at":"2026-10-28T23:36:39+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T23:36:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MailWatch for MailScanner to `1.2.27` or later","reach":"internet","title":"MailWatch: low-privilege users can release or delete other users' quarantined mail","impact":"medium","summary":"MailWatch for MailScanner lets any logged-in user, including plain user and domain-admin roles, pass an arbitrary message ID to the quarantine action, skipping the per-role ownership filter. An attacker can force-deliver or permanently delete quarantined mail belonging to other users or domains.","category":"package","nicknames":[],"who_cares":["mailwatch","mailscanner","self-hosted","email"],"confidence":0.8,"needs_auth":"yes","worst_case":"Other users' quarantined mail is force-delivered or permanently deleted","analyst_note":"","how_to_check":"- Check the installed MailWatch version and confirm whether it is below `1.2.27`\n- Look for the file `mailscanner/quarantine_action.php` in the MailWatch install and confirm it is present","needs_analyst":false,"not_affected_if":["version-1.2.27-or-later"],"who_is_affected":"Sites running MailWatch for MailScanner before `1.2.27` where more than one user or domain has accounts that can reach the quarantine views. Single-user installs with only administrator accounts face less exposure from other users, but the flaw still lets any authenticated account act on quarantined mail. unknown for whether the sources list other affected deployment types.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000624,"input_tokens":3544,"output_tokens":540,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-85749':16A,19A '1.2.27':92C,230C 'action':52B,129C,159C 'admin':42B 'allow':192C 'appli':152C 'arbitrari':46B,123C 'attack':61B 'authent':94C 'base':84C 'belong':71B 'call':131C 'caller':169C,176C 'check':187C 'csrf':165C 'cve':14A,17A 'd/domain-admin':100C 'delet':9A,68B,110C,204C,222C 'deliv':65B,214C 'domain':41B,76B,119C,209C 'domain-admin':40B 'email':20B 'end':87C 'enumer':191C 'filter':59B,151C 'fix':227C 'forc':64B,213C 'force-deliv':63B,212C 'front':86C 'front-end':85C 'global':150C 'h/host':102C 'held':216C 'host':26B 'id':48B,125C 'identifi':144C,189C 'inbox':107C 'includ':36B,97C 'invok':199C 'issu':225C 'item':134C 'let':30B 'list':133C,154C 'log':33B 'logged-in':32B 'low':3A,195C 'low-privileg':2A,194C 'mail':13A,70B,113C,215C 'maillog':140C 'mailscann':21B,29B,79C,89C 'mailscanner/functions.php':136C 'mailscanner/quarantine_action.php':127C 'mailwatch':1A,22B,27B,77C,95C 'messag':47B,124C,184C,188C,211C 'never':186C 'ownership':58B,180C 'packag':23B 'pass':44B 'path':130C 'per':56B,148C 'per-rol':55B,147C 'perman':67B,109C,221C 'plain':37B 'prior':90C 'privileg':4A,196C 'quarantin':12A,51B,69B,112C,132C,200C,203C,210C,219C 'read':156C 'releas':7A,105C,201C 'request':183C 'requir':160C 'role':43B,57B,103C,149C 'select':138C 'self':25B 'self-host':24B 'session':163C,179C 'skip':53B 'submit':171C 'suppli':121C,143C 'token':166C,173C 'u/user':99C 'user':5A,11A,35B,38B,74B,96C,117C,197C,207C 'valid':162C 'version':229C 'view':157C 'web':83C 'web-bas':82C 'without':145C","nicknames":[],"mitigations":[],"who_affected":"Sites running MailWatch for MailScanner before `1.2.27` where more than one user or domain has accounts that can reach the quarantine views. Single-user installs with only administrator accounts face less exposure from other users, but the flaw still lets any authenticated account act on quarantined mail. unknown for whether the sources list other affected deployment types.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T23:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85749","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85749","severity":null,"published_at":"2026-10-28T23:17:11+00:00","modified_at":"2026-10-28T23:17:11+00:00","first_seen_at":"2026-10-28T23:35:49+00:00","fetched_at":"2026-10-28T23:35:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}