High · published December 11, 2025
⚡ If you’re running MailEnable versions prior to 10.54, user credentials are just hanging out in plaintext! 😱 Think of it like leaving your house keys under the welcome mat — accessible to anyone who knows where to look. With overly permissive access to the AUTH.TAB file, local users can easily read sensitive passwords stored in plain sight. An attacker with local access could snatch all user credentials and even super-admin passwords, leading to unauthorized mailbox access. This means full control over MailEnable services like POP3 and SMTP, putting your entire email infrastructure at risk!
Think of it like leaving your house keys under the welcome mat — accessible to anyone who knows where to look. With overly permissive access to the AUTH.TAB file, local users can easily read sensitive passwords stored in plain sight. This vulnerability allows local, authenticated users to read usernames and passwords stored in plaintext in the AUTH.TAB file, thanks to lax filesystem permissions. It poses a significant risk of account takeover and unauthorized access to MailEnable services.
An attacker with local access could snatch all user credentials and even super-admin passwords, leading to unauthorized mailbox access. This means full control over MailEnable services like POP3 and SMTP, putting your entire email infrastructure at risk! Upgrade MailEnable to version 10.54 or later to eliminate this vulnerability. Additionally, tighten filesystem permissions to ensure only authorized users can access sensitive files like AUTH.TAB. You've got this! Secure your MailEnable setup and keep those keys where they belong — in a safe place! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mailenable/mailenable | < 10.54 | 10.54 |