{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/mailwatch/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mailwatch:mailwatch_for_mailscanner:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-85749"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MailWatch for MailScanner (\u003c 1.2.27)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["MailWatch"],"content_html":"\u003cp\u003eMailWatch for MailScanner versions prior to 1.2.27 contain an insecure direct object reference (IDOR) vulnerability. The application fails to validate message ownership or apply role-based global filters when processing actions in \u003ccode\u003emailscanner/quarantine_action.php\u003c/code\u003e. Authenticated users with any role - including low-privilege User, Domain-Admin, or Host - can enumerate message IDs to trigger \u003ccode\u003equarantine_release()\u003c/code\u003e or \u003ccode\u003equarantine_delete()\u003c/code\u003e for quarantined mail belonging to other users or domains. While the endpoint requires a valid session and CSRF token, these are satisfied by the attacker's own session, bypassing authorization.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated low-privilege users to force-deliver sensitive quarantined emails to any inbox or permanently delete messages from other users or domains, leading to potential data exfiltration or denial of service of security filtering capabilities.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade MailWatch for MailScanner to version 1.2.27 or later immediately to apply the required ownership checks in \u003ccode\u003emailscanner/functions.php\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAudit web server logs for anomalous patterns of repeated \u003ccode\u003ePOST\u003c/code\u003e requests to \u003ccode\u003equarantine_action.php\u003c/code\u003e originating from single authenticated sessions, specifically looking for high volumes of unique ID parameters.\u003c/li\u003e\n\u003cli\u003eRestrict access to the MailWatch interface to authorized IP ranges where possible to mitigate the risk of compromised user accounts being used for automated mass-manipulation of quarantined messages.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-29T05:04:12Z","date_published":"2026-10-29T05:04:12Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mailwatch-insecure-direct-object-reference/","summary":"Authenticated MailWatch users can perform unauthorized release or deletion of arbitrary quarantined messages across all domains due to an insufficient ownership check in the quarantine action endpoint.","title":"MailWatch for MailScanner: Unauthorized quarantine access (CVE-2026-85749)","url":"https://feed.craftedsignal.io/briefs/2026-10-mailwatch-insecure-direct-object-reference/"}],"language":"en","title":"CraftedSignal Threat Feed - MailWatch","version":"https://jsonfeed.org/version/1.1"}