CVE-2026-44400

CriticalCVSS 9.8/10Last modified Oct 26, 2026

Description

MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile portal that allows attackers to bypass authentication checks by reusing AuthenticationToken cookies generated for low-privileged users. Attackers can obtain a token from the WebMail login endpoint using the PersistentLogin parameter and replay it against the WebAdmin portal to perform highly privileged administrative actions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
MailEnable	MailEnable Enterprise Premium	<= 10.55

References

https://www.mailenable.com/Premium-ReleaseNotes.txtRelease Notes
https://www.vulncheck.com/advisories/mailenable-enterprise-premium-authorization-bypass-via-webadminThird Party Advisory

Timeline

Published: May 8, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-444014.8Typemill CMS version 2.x contains a persistent cross-site scripting vulnerability in the Markdown parser extension that allows authenticated CVE-2026-444029.8Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint CVE-2026-444037.2Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allow CVE-2026-444053.4In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.CVE-2026-444067.8ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, success CVE-2026-444077.5A remote denial-of-service vulnerability exists in the ZTE Cloud PC client uSmartview, which may lead to memory corruption and remote denial CVE-2026-444086.3There is an unauthorized access vulnerability in ZTE MU5250. Due to improper permission control of the Web interface, an unauthorized attack CVE-2026-444097.5There is an an information disclosure vulnerability in ZTE MU5250. Due to improper configuration of the access control mechanism, attackers CVE-2026-44418.8Use after free in Base in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a craft CVE-2026-444103.8This vulnerability stems from a business logic flaw.Attackers can exploit legitimate application functions in unintended and abnormal ways, CVE-2026-444117.8A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected application is vulnerable to uniniti CVE-2026-444127.8A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected applications contain a stack based o