MailWatch for MailScanner: Unauthorized quarantine access (CVE-2026-85749)

MailWatch for MailScanner versions prior to 1.2.27 contain an insecure direct object reference (IDOR) vulnerability. The application fails to validate message ownership or apply role-based global filters when processing actions in mailscanner/quarantine_action.php. Authenticated users with any role - including low-privilege User, Domain-Admin, or Host - can enumerate message IDs to trigger quarantine_release() or quarantine_delete() for quarantined mail belonging to other users or domains. While the endpoint requires a valid session and CSRF token, these are satisfied by the attacker's own session, bypassing authorization.

Impact

Successful exploitation allows authenticated low-privilege users to force-deliver sensitive quarantined emails to any inbox or permanently delete messages from other users or domains, leading to potential data exfiltration or denial of service of security filtering capabilities.

Recommendation

1. Upgrade MailWatch for MailScanner to version 1.2.27 or later immediately to apply the required ownership checks in mailscanner/functions.php.
2. Audit web server logs for anomalous patterns of repeated POST requests to quarantine_action.php originating from single authenticated sessions, specifically looking for high volumes of unique ID parameters.
3. Restrict access to the MailWatch interface to authorized IP ranges where possible to mitigate the risk of compromised user accounts being used for automated mass-manipulation of quarantined messages.