{"id":"CVE-2026-104084","published":"2026-10-09T16:17:21.153","lastModified":"2026-10-12T14:17:09.200","description":"SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token issued before an administrator demotion, or a demoted user whose session was not actively polling at the time of demotion, can replay the stale token to obtain a new access token retaining the higher-privilege role (such as DomainAdmin or SysAdmin) until natural token expiry.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-613"],"vendors":[],"products":[],"references":[{"url":"https://blog.evan.lat/posts/sm/","tags":[]},{"url":"https://www.smartertools.com/smartermail/release-notes/current#/9526:~:text=Build%209777%20(Oct%208%2C%202026)","tags":[]},{"url":"https://www.vulncheck.com/advisories/smartermail-build-9777-stale-jwt-role-claim-privilege-escalation-via-refresh-token","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The vulnerability allows attackers to escalate privileges by replaying stale JWT tokens that retain elevated roles like DomainAdmin or SysAdmin, even after users have been demoted. This occurs because the system doesn't revalidate user roles when refreshing tokens.","exploitability":"Exploitation requires capturing a refresh token before a user demotion and replaying it within the token's natural expiry window, making it moderately difficult but possible with persistent monitoring.","blast_radius":"The impact could be significant as attackers can gain full administrative access to email accounts and potentially compromise entire domains through elevated privilege token replay.","remediation":"Upgrade to SmarterMail build 9777 or later to fix the JWT role validation issue.","detection":"Monitor for POST /api/v1/auth/refresh-token API calls with tokens that show role claims inconsistent with the current user's assigned roles in the system logs.","tags":["auth","privilege-escalation","jwt"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:51:33.256Z"}}