MailEnable XXE flaw lets authenticated attackers read sensitive data
Original title: ZDI-26-811: MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability
ZDI rates CVE-2026-114552 at CVSS 6.5; login is required and no fix or affected versions are named.
ZDI published ZDI-26-811, an XML external entity issue in MailEnable's parseObjectResponse handling. Remote attackers who authenticate can disclose sensitive information on affected installations. ZDI assigns CVE-2026-114552 and a CVSS score of 6.5. The advisory does not name versions, a patch, or exploitation.
Unconfirmed: Affected versions, a fix, and whether it is exploited are not stated.
- ZDI advisory ID is ZDI-26-811.
- The flaw is XXE processing in parseObjectResponse.
- Authentication is required to exploit it.
- Assigned CVE is CVE-2026-114552 with CVSS 6.5.
Impact: Authenticated remote disclosure of sensitive information
| Product | Affected |
|---|---|
| MailEnable | — |
- CVEs
- CVE-2026-114552
- Vendors
- MailEnable
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114552 | XXE Information Disclosure in MailEnable | 6.5 | — |
From the original article
This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.