MailEnable cleartext auth storage leaks data without login
Original title: ZDI-26-810: MailEnable Auth Cleartext Storage Information Disclosure Vulnerability
ZDI rates CVE-2026-114551 at CVSS 5.9 and says authentication is not required.
ZDI published ZDI-26-810, an information-disclosure flaw tied to MailEnable storing authentication data in cleartext. Remote attackers can disclose sensitive information on affected installations without authenticating. ZDI assigns CVE-2026-114551 and a CVSS score of 5.9. Versions, a patch, and exploitation status are not given.
Unconfirmed: Affected versions, a fix, and real-world exploitation are not stated.
- ZDI advisory ID is ZDI-26-810.
- The issue is cleartext storage of authentication data.
- Exploitation does not require authentication.
- Assigned CVE is CVE-2026-114551 with CVSS 5.9.
Impact: Unauthenticated remote disclosure of sensitive information
| Product | Affected |
|---|---|
| MailEnable | — |
- CVEs
- CVE-2026-114551
- Vendors
- MailEnable
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114551 | Cleartext Credential Storage in MailEnable Authentication | 5.9 | — |
From the original article
This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.