CVE-2026-13164: Mailerup 0 to before 1.0.1

Affected technology

Mailerup · 0 to before 1.0.1
Mailerup

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

A remote, unauthenticated attacker can self-register a working account on instances where registration is intended to be restricted, because the endpoint applies the AllowAny permission with no email verification, CAPTCHA, or administrator approval. Source advisory’s CVSS 4.0 assessment (base score 8.8/10) rates confidentiality impact as high; integrity impact as low; availability impact as none.