Skip to content
OpenAdvisories

Product · SmarterTools

SmarterMail

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.8
    CVE-2026-104084

    SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token

    SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. At…

    SmarterTools SmarterMail
  • High 7.2
    CVE-2026-104082 Public exploit

    SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount

    SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary Fil…

    SmarterTools SmarterMail
  • High 8.1
    CVE-2026-7807

    SmarterTools SmarterMail < Build 9560 Server Local File Inclusion via the /api/v1/report/summary/{type} API

    SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authenticated users to read arbitrary .json files on the system. Attackers can exploit this vulnerability …

    SmarterTools SmarterMail
  • High 7.2
    CVE-2026-26930

    SmarterTools SmarterMail before 9526 allows XSS via MAPI requests.

    SmarterTools SmarterMail