PT-2026-39194 · Mailenable · Mailenable Enterprise Premium

Dninh · Published 2026-05-08 · Updated 2026-05-09 · CVE-2026-44400

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MailEnable Enterprise Premium versions prior to 10.56

Description Improper authorization in the WebAdmin mobile portal allows attackers to bypass authentication checks by reusing AuthenticationToken cookies generated for low-privileged users. An attacker can obtain a token from the 'WebMail login' endpoint using the PersistentLogin parameter and replay it against the WebAdmin portal to perform highly privileged administrative actions.

Recommendations Update to a version later than 10.55.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-44400

Affected Products

Mailenable Enterprise Premium

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-44400 · Security Note
• https://vulncheck.com/advisories/mailenable-enterprise-premium-authorization-bypass-via-webadmin · Note
• https://mailenable.com/Premium-ReleaseNotes.txt · Note
• https://twitter.com/CVEnew/status/2053131443413582186 · Twitter Post