Advisories · Technology
Mailu.
Every CVE that names Mailu among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.2 High
Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control
- Mailu
- Broken access control
- CVSS 7.2 High
Mailu domain managers can take over higher-privileged accounts
- Mailu
- Privilege escalation
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust
- Mailu
- Mailu helm-charts
- Authentication bypass
- CWE-807
- CVSS 7.5 High
Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions
- Mailu
- Authentication bypass
- CVSS 8.7 High
Unspecified vulnerability in the fetchmail script in Mailu
- Mailu
- Broken access control