MailEnable cleartext auth storage leaks data without login
ZDI rates CVE-2026-114551 at CVSS 5.9 and says authentication is not required.
42
CVE-2026-114551
Cleartext Credential Storage in MailEnable Authentication
- CVSS 3.0
- 5.9 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
MailEnable stores mailbox credentials in plaintext. Remote attackers can exploit this without authentication. They may disclose sensitive data and combine it with other vulnerabilities for further compromise. This affects all MailEnable installations.
What to do: Apply MailEnable's update for CVE-2026-114551
| Product | Affected |
|---|---|
| MailEnable | — |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
MailEnable Auth Cleartext Storage Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of mailbox credentials. The issue results from storing sensitive information in plaintext. An attacker can leverage this in conjunction with other vulnerabilities to disclose stored credentials, leading to further compromise. Was ZDI-CAN-34478.
- Weakness
- CWE-312
- Vector
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N