CVE-2026-104084: Insufficient Session Expiration in Smartertools Smartermail

SmarterMail versions prior to build 9777 contain a vulnerability where JWT refresh tokens embed a role claim at issuance that is not checked against the current account role during token refresh via POST /api/v1/auth/refresh-token. Consequently, if an attacker obtains a refresh token issued before a user's privilege demotion, or if a demoted user's session was not actively polling at the time of demotion, the attacker can replay the stale token to gain a new access token retaining the higher privilege role such as DomainAdmin or SysAdmin. This flaw leads to privilege escalation until the token expires naturally.

An attacker can maintain or regain elevated privileges by replaying stale refresh tokens that were issued before a user's role was downgraded. This can result in unauthorized administrative access (DomainAdmin or SysAdmin roles) despite the user's current reduced privileges, potentially allowing unauthorized actions within the SmarterMail system. The vulnerability has a high severity rating with a CVSS 4.0 score of 8.7.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider invalidating all existing refresh tokens upon role changes or demotions and enforce re-authentication to prevent reuse of stale tokens. Monitoring for unusual token refresh activity may help detect exploitation attempts.