{"id":"CVE-2026-86009","published":"2026-10-16T17:17:51.920","lastModified":"2026-10-16T17:17:52.030","description":"Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-285","CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Mailu/Mailu/commit/f05aeb8322e2f61096af6b089d61ba6f40587d96","tags":[]},{"url":"https://github.com/Mailu/Mailu/issues/2686","tags":[]},{"url":"https://github.com/Mailu/Mailu/pull/4072","tags":[]},{"url":"https://github.com/Mailu/Mailu/security/advisories/GHSA-crww-m82r-2wfm","tags":[]}],"exploitRefs":[{"url":"https://github.com/Mailu/Mailu/commit/f05aeb8322e2f61096af6b089d61ba6f40587d96","tags":[]},{"url":"https://github.com/Mailu/Mailu/issues/2686","tags":[]},{"url":"https://github.com/Mailu/Mailu/pull/4072","tags":[]},{"url":"https://github.com/Mailu/Mailu/security/advisories/GHSA-crww-m82r-2wfm","tags":[]}],"hasPoc":true,"ai":null}