CVE-2026-13164 Mailerup CVE debrief

Who should care

Defenders and administrators of MailerUp instances should assess their exposure and verify instance configurations to prevent unauthorized access to stored email data. This includes reviewing current configurations, identifying potential vulnerabilities, and implementing necessary security measures to restrict registration endpoints and monitor for suspicious activity. Additionally, security teams and vulnerability management teams should prioritize patch

Why it matters

CVE-2026-13164 is a high-severity vulnerability in MailerUp that allows unauthenticated attackers to self-register accounts and access stored email data. Defenders should prioritize verifying instance configurations, restricting registration endpoints, and monitoring for suspicious activity.

• Potential unauthorized access to stored email data.
• Increased risk of email data exposure due to unauthenticated self-registration.
• Need for verification of instance configurations and registration endpoint restrictions.
• Potential for exploitation requires verification from official sources.

Technical summary

The vulnerability exists in the RegisterView of MailerUp, specifically in the apps/accounts/views.py file, which is exposed at the POST /api/auth/register/ endpoint. The endpoint applies the AllowAny permission, allowing remote, unauthenticated attackers to self-register working accounts on instances where registration is intended to be restricted. This issue arises from a missing authentication mechanism in the RegisterView, which allows unauthenticated attackers to create accounts without email verification, CAPTCHA, or administrator approval. Any account created this way can read all email stored by the instance, resulting in full disclosure of stored messages to an arbitrary unauthenticated attacker. DefeNd

Defensive priority

Defenders should prioritize verifying instance configurations, restricting registration endpoints, and monitoring for suspicious account creation activity.

Recommended defensive actions

• Verify instance configurations to restrict registration endpoints.
• Monitor for suspicious account creation activity.
• Implement additional security measures, such as email verification or CAPTCHA, for registration processes.
• Review and update instance configurations to ensure proper authentication and authorization.
• Confirm whether affected MailerUp deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 8.8 and CWE-306 classification. However, the corpus lacks specific information on affected versions, exploitation, or remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.