CVE-2026-44400 is a high severity improper authorization flaw (CVSS 8.1) in MailEnable Enterprise Premium 10.55 and earlier. A token from a low privilege WebMail login can be replayed against the WebAdmin mobile portal for administrative actions. Upgrade to the newest release listed in the vendor notes.
What's affected
From the record and the VulnCheck advisory:
- Affected: MailEnable Enterprise Premium 10.55 and earlier. The VulnCheck page titles the range as before 10.55, so check your exact version.
- Fixed: the sources I fetched do not state the fixed release for this issue. The vendor release notes list 10.60, dated 1 October 2026, as the newest release at the time of writing.
Read the vendor release notes for the entry that covers this authorization fix, and confirm with the vendor if it is not named.
How to check if you're exposed
Find the installed version in the MailEnable administration console under the about or help section. Then check how the WebAdmin mobile portal is exposed:
- Is it reachable from the internet?
- Which accounts can log in to WebMail with the persistent login option?
Review web server logs for WebAdmin requests that carry a WebMail session cookie from a mailbox account.
What to do now
- Upgrade MailEnable to the newest release and read its notes for the fix to this authorization issue.
- Limit WebAdmin to administrator networks, or block it from the internet.
- Review administrative changes made in the last months for ones you did not make, such as new accounts or changed settings.
- Consider turning off the persistent login option for WebMail until you are on a fixed release.
Why it matters
The class is CWE-639 (authorization bypass through user controlled key). The WebAdmin portal accepted a token that a lower privilege flow had issued, without checking that it was meant for administration. A token should be bound to the audience and role it was issued for.
Mail servers hold sensitive data and often sit on the internet, so an authorization gap in an admin portal is a real concern. The record does not mark this CVE as KEV.
Quick check
Which version fixes it?
The fetched sources do not name it. Check the vendor release notes and confirm with the vendor.
Sources
Last reviewed: 19 October 2026.
