Skip to content
OpenAdvisories
High WID-SEC-2026-3869 3 CVEs

SmarterTools SmarterMail: Mehrere Schwachstellen

Published Oct 11, 2026 · Updated Oct 11, 2026 · de-DE

Vendor: SmarterTools Product: SmarterMail Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in SmarterTools SmarterMail ausnutzen, um beliebigen Code mit SYSTEM-Rechten auszuführen, erhöhte Rechte auch weiterhin zu behalten, nachdem die Administratorrechte entzogen wurden, Cross-Site-Scripting-Angriffe zu starten, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren sowie weitere, unspezifizierte Angriffe durchzuführen.

Product

SmarterMail von SmarterTools ist eine Mailserver-Software.

Vulnerabilities 3

  • High 8.8
    CVE-2026-104084

    SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token

    SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. At…

    SmarterTools SmarterMail
  • High 7.2
    CVE-2026-104082 Public exploit

    SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount

    SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary Fil…

    SmarterTools SmarterMail
  • Medium 6.1
    CVE-2026-104083

    SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content

    SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a <style> element nested within MathML foreign content (<math><mtext><mglyph>), whi…

    SmarterTools SmarterMail

Revision history

  1. #1

    Initiale Fassung

References