ZDI 2026-10-27

ZDI-26-810: MailEnable Auth Cleartext Storage Information Disclosure Vulnerability

CVE-2026-114551

Machine-generated analysis · WAYSCloud LLM

Unauthenticated remote attackers can retrieve cleartext authentication data from MailEnable.

Context

The advisory concerns MailEnable's authentication storage component. It describes an information disclosure vulnerability where cleartext credentials can be obtained without authentication. The advisory assigns a CVSS score of 5.9 to this issue.

Operator considerations

Check: Verify MailEnable installations for cleartext authentication storage and identify affected versions.
Log: Record any access attempts to authentication files or related endpoints.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.9. The following CVEs are assigned: CVE-2026-114551.

Read the full advisory on ZDI →