Live › vulnerability › CVE-2026-86008
Go to dashboardMailu is a self-hosted mail server shipped as Docker images. A domain manager can reset passwords or obtain tokens for an administrative account or a domain manager with more privileges, taking over that account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running self-hosted Mailu that grant domain manager roles to users. Installations with only global admins and no delegated domain managers are less exposed. Unknown whether managed mail hosting is affected.
No product ranges from the sources yet.
8577c929b4ade04d3cd4210cf036601abd7935568577c929b4ade04d3cd4210cf036601abd793556Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain manager to take over a higher-privileged account and exercise that account's permissions. This vulnerability is addressed by commit 8577c929b4ade04d3cd4210cf036601abd793556.
This page as .md · .json · in your agent: get_signal("CVE-2026-86008")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.