These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to.
Mailu domain managers can take over higher-privileged accounts due to an authorization failure. This vulnerability is addressed in commit 8577c929b4ade04d3cd4210cf036601abd793556. The issue arises from a domain manager targeting an administrative account or another domain manager with greater privileges, allowing them to reset passwords or obtain tokens for that account. Defenders should assess exposure a [truncated]
Mailu is a mail server provided as a set of Docker images. A missing authorization check in the Mailu admin REST API allows unauthenticated attackers to remove IP restrictions or update comments for existing user tokens if the REST API is enabled. This issue was addressed in Mailu version 2024.06.52. Users can upgrade to receive a patch or turn off the REST API as a workaround.