Mailu vulnerabilities
We track 4 vulnerabilities in Mailu products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 16, 2026.
Latest Mailu vulnerabilities
- 8.2 High severity
Mailu: Improper Authorization
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for anoth
- 7.2 High severity
Mailu: Improper Privilege Management
Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for tha
- 9.8 Critical severity
Mailu: Authentication Bypass by Spoofing
Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for
- 7.5 High severity
Mailu: Missing Authentication for Critical Functionality
Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing us