Mailu vulnerabilities

5 published CVEs name Mailu among the affected products.

Critical 1High 4Medium 0Low 0Not scored 0

CVEs per yearBy the year they were published

CVE-2026-86009
Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control
Mailu · Mailu
High8.2
CVE-2026-86008
Mailu domain managers can take over higher-privileged accounts
Mailu · Mailu
High7.2
CVE-2026-85751
Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust
Mailu · Mailu
Critical9.8
CVE-2026-49217
Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions
Mailu · Mailu
High7.5
CVE-2020-5239
Unspecified vulnerability in the fetchmail script in Mailu
Mailu · Mailu
High8.7