CVE-2026-85749— MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail
Quick assessment
Affected
mailwatch MailWatch
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MailWatch 是 MailScanner 的基于 Web 的前端界面。在 1.2.27 版本之前，任何已认证的 MailWatch 用户（包括 U/user、D/domain-admin 和 H/host 角色）均可通过向 提交任意邮件 ，将其他用户或域的被隔离邮件释放到收件箱，或永久删除这些邮件。该操作路径会调用 中的 函数，该函数仅根据提供的标识符从 表中选取记录，但未应用列表和读取视图中所使用的基于角色的 。虽然该操作需要有效的会话和 CSRF 令牌，但调用者可提交其自身会话中的令牌；系统从未检查所请求
Possible ATT&CK Techniques 3 AI
T1070 · Indicator Removal T1086 T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85749
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail
Source: CVE Program / CVE List V5
Vulnerability Description
MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any authenticated MailWatch user, including the U/user, D/domain-admin, and H/host roles, can release to inbox or permanently delete the quarantined mail of any other user or domain by supplying an arbitrary message `id` to `mailscanner/quarantine_action.php`. The action path calls `quarantine_list_items()` in `mailscanner/functions.php`, which selects from `maillog` by the supplied identifier without the per-role `global_filter` applied by listing and read views. The action requires a valid session and CSRF token, but the caller can submit a token from the caller's own session; ownership of the requested message is never checked. Message identifiers are enumerable, allowing a low-privilege user to invoke `quarantine_release()` or `quarantine_delete()` for other users' or domains' quarantined messages, force-delivering mail held by the quarantine or permanently deleting it. This issue is fixed in version 1.2.27.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制SQL主密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-85749
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85749
请登录查看更多情报信息。