Mailu

Latest 2024.06.65 Oct 20, 2026

Recent releases

securityFixes GHSA-h3q9-vqhp-pc9x: Rate limiting bypass

securityroundcube 1.6.17 - fix multiple CVEs: CVE-2026-54432 CVE-2026-54433

securityEnsure we set X-Forwarded-By, see GHSA-rfhj-4wcq-74xg

securityFix CVE-2026-49217

low CVE-2026-86009 Domain managers can allow themselves to spoof hosted domains they do not control

7.2 CVE-2026-86008 Multiple authorization issues affecting domain managers

5.3 GHSA-h3q9-vqhp-pc9x Rate limiting bypass

7.5 CVE-2024-49767 DoS vector

9.3 GHSA-7mff-qrqm-v4q7 XSS on /Autodiscover/Autodiscover.xml

9.8 CVE-2026-85751 Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust

7.5 CVE-2026-49217 Missing authentication on PATCH /api/v1/token/<id> allows unauthenticated removal of IP restrictions

high GHSA-3h96-x359-qrwm Multiple security issues in dovecot (Mailus IMAP&POP Server) — CVE-2020-25275, CVE-2020-24386, (CVE-2020-12100)

low GHSA-phg4-wh78-w97x Antivirus-service may be unwantedly disabled in existing and new installations

8.7 CVE-2020-5239 Unspecified vulnerability in the fetchmail script