CVE-2026-86009 in Mailu
Summary
by MITRE • 10/16/2026
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The Mailu mail server platform, which operates as a suite of Docker images designed to simplify email infrastructure deployment, contained a critical authorization flaw that allowed domain managers to bypass intended security controls regarding email authentication and spoofing restrictions. This vulnerability specifically affected the administrative interface where users with manager privileges for one hosted domain could manipulate configuration settings for other domains within the same Mailu instance. The core technical issue stemmed from an insufficient check on resource ownership during the process of enabling or disabling spoofing permissions, a feature that typically restricts whether emails sent by authenticated users can claim to originate from specific domains without proper verification mechanisms in place.
In a properly secured environment, domain managers should only have administrative control over the specific domains they are assigned to manage, ensuring that security policies such as DKIM signing and SPF alignment enforcement apply strictly within their authorized scope. However, prior to commit f05aeb8322e2f61096af6b089d61ba6f40587d96, the application logic failed to validate that the domain being modified for spoofing permissions actually belonged to or was under the control of the requesting administrator. This lack of object-level access control meant that a malicious actor with manager rights for Domain A could arbitrarily enable spoofing capabilities for Domain B, which they did not own and had no legitimate business managing within the system.
The operational impact of this flaw is significant from both a security and compliance perspective. By enabling spoofing for an external domain, an attacker can send emails that appear to originate from that target domain while successfully passing DKIM (DomainKeys Identified Mail) and SPF (Sender Policy Framework) checks. These protocols are designed to verify the authenticity of email sources and prevent forgery; when they pass erroneously due to misconfiguration caused by this vulnerability, it severely undermines trust in the email ecosystem. Attackers can leverage this capability for sophisticated phishing campaigns where recipients see a legitimate sender address that also passes technical authentication checks, making detection significantly harder for end-users and automated filtering systems alike.
This type of flaw aligns with CWE-269, which describes Improper Privilege Control, as it involves an actor obtaining privileges or performing actions beyond their authorized scope due to inadequate authorization logic. Furthermore, the ability to forge email headers that pass authentication checks facilitates social engineering attacks consistent with MITRE ATT&CK technique T1534, specifically Internal Spearphishing using Trusted Domains. The exploitation of this vulnerability allows adversaries to bypass organizational defenses by leveraging trusted domains within their control or influence, thereby increasing the likelihood of successful credential theft or malware delivery through deceptive email communications.
The issue was resolved in commit f05aeb8322e2f61096af6b089d61ba6f40587d96 by implementing strict validation checks that ensure domain managers can only modify spoofing settings for domains they explicitly own or are authorized to manage. To mitigate the risk associated with this vulnerability, organizations running Mailu must upgrade to a version containing this fix immediately if they have not already done so. Additionally, administrators should review their current user roles and permissions to ensure that no unnecessary privileges are granted to domain managers, adhering to the principle of least privilege. Regular audits of email authentication configurations across all hosted domains can also help detect any unauthorized changes or misconfigurations before they lead to security incidents.