Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

ZDI publishes two MailEnable information-disclosure flaws

1 source · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

ZDI disclosed two MailEnable information-disclosure flaws, one unauthenticated and one requiring login, with no versions, patches, or exploitation status named.

ZDI published two information-disclosure advisories for MailEnable on October 27, 2026. ZDI-26-810, tracked as CVE-2026-114551 with a CVSS score of 5.9, involves cleartext storage of authentication data and does not require authentication. ZDI-26-811, tracked as CVE-2026-114552 with a CVSS score of 6.5, is an XML external entity issue in parseObjectResponse and requires an authenticated attacker. Neither advisory names affected versions, a patch, or whether the flaws are being exploited.

Key facts
  • ZDI-26-810 is CVE-2026-114551, CVSS 5.9, cleartext authentication storage.
  • Exploiting ZDI-26-810 does not require authentication.
  • ZDI-26-811 is CVE-2026-114552, CVSS 6.5, XXE in parseObjectResponse.
  • Exploiting ZDI-26-811 requires the attacker to authenticate.
  • Neither advisory names versions, a patch, or exploitation status.
Analyze CVE-2026-114551 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 27, 2026ZDI publishes two MailEnable information-disclosure advisories · ZDI Published Advisories

What each outlet adds

beyond the shared facts
  • ZDI Published AdvisoriesCleartext auth storage flaw CVE-2026-114551, CVSS 5.9, no login.
  • ZDI Published AdvisoriesXXE in parseObjectResponse, CVE-2026-114552, CVSS 6.5, login required.
CVEs
CVE-2026-114551CVE-2026-114552
Vendors
MailEnable
Organizations
Zero Day Initiative

Coverage

oldest first · one row per article · UTC
  1. · 15d ago ZDI Published AdvisoriesFirst report

    MailEnable cleartext auth storage leaks data without login

    ZDI rates CVE-2026-114551 at CVSS 5.9 and says authentication is not required.

  2. · 15d ago ZDI Published Advisories

    MailEnable XXE flaw lets authenticated attackers read sensitive data

    ZDI rates CVE-2026-114552 at CVSS 6.5; login is required and no fix or affected versions are named.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-114552
+1 related CVE
CVE-2026-114551
XXE Information Disclosure in MailEnable
6.5
group max
—