MailWatch - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/mailwatch/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 05:04:12 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMailWatch for MailScanner: Unauthorized quarantine access (CVE-2026-85749)https://feed.craftedsignal.io/briefs/2026-10-mailwatch-insecure-direct-object-reference/Thu, 29 Oct 2026 05:04:12 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-mailwatch-insecure-direct-object-reference/Authenticated MailWatch users can perform unauthorized release or deletion of arbitrary quarantined messages across all domains due to an insufficient ownership check in the quarantine action endpoint.MailWatch for MailScanner versions prior to 1.2.27 contain an insecure direct object reference (IDOR) vulnerability. The application fails to validate message ownership or apply role-based global filters when processing actions in mailscanner/quarantine_action.php. Authenticated users with any role - including low-privilege User, Domain-Admin, or Host - can enumerate message IDs to trigger quarantine_release() or quarantine_delete() for quarantined mail belonging to other users or domains. While the endpoint requires a valid session and CSRF token, these are satisfied by the attacker's own session, bypassing authorization.

Impact

Successful exploitation allows authenticated low-privilege users to force-deliver sensitive quarantined emails to any inbox or permanently delete messages from other users or domains, leading to potential data exfiltration or denial of service of security filtering capabilities.

Recommendation

  1. Upgrade MailWatch for MailScanner to version 1.2.27 or later immediately to apply the required ownership checks in mailscanner/functions.php.
  2. Audit web server logs for anomalous patterns of repeated POST requests to quarantine_action.php originating from single authenticated sessions, specifically looking for high volumes of unique ID parameters.
  3. Restrict access to the MailWatch interface to authorized IP ranges where possible to mitigate the risk of compromised user accounts being used for automated mass-manipulation of quarantined messages.
]]>highadvisory