CVE-2026-86009High· 8.2▾ TwilightMailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator ena…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.
Mailu < f05aeb8322e2f61096af6b089d61ba6f40587d96Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86008High· 7.2Mailu domain managers can take over higher-privileged accounts
CVE-2026-85751Critical· 9.8Mailu is a mail server distributed as a set of Docker images
CVE-2026-105703Medium· 4.7A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3
CVE-2026-101006Medium· 4.3A flaw has been found in Frappe HR up to 16.15.0
CVE-2025-15126Low· 3.1A weakness has been identified in JeecgBoot up to 3.9.0
CVE-2025-15124Low· 3.1A vulnerability was identified in JeecgBoot up to 3.9.0