SmarterTools SmarterMail up to 9560 refresh-token privileges management

Summaryinfo

A vulnerability classified as critical was found in SmarterTools SmarterMail. This affects an unknown function of the file /api/v1/auth/refresh-token. Such manipulation leads to privileges management. This vulnerability is referenced as CVE-2026-104084. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in SmarterTools SmarterMail and classified as critical. Affected by this issue is an unknown function of the file /api/v1/auth/refresh-token. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token issued before an administrator demotion, or a demoted user whose session was not actively polling at the time of demotion, can replay the stale token to obtain a new access token retaining the higher-privilege role (such as DomainAdmin or SysAdmin) until natural token expiry.

The advisory is shared for download at smartertools.com. This vulnerability is handled as CVE-2026-104084 since 10/01/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 9777 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• SmarterTools

Name

• SmarterMail

Version

• 1.6.1511
• 1.6.1529
• 4.3
• 5.0.2999
• 7.1.3876
• 9.2
• 13.3.5535
• 16.x Build 8747
• 100.0.7803
• 100.0.9511
• 100.0.9518
• 100.0.9610
• 7776
• 9526
• 9560

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion