CVE-2026-44400 is an improper authorization vulnerability (CWE-639) in MailEnable Enterprise Premium 10.55 and earlier. The issue exists in the WebAdmin mobile portal where AuthenticationToken cookies generated for low-privileged users can be reused to bypass authentication checks. Attackers can obtain such tokens from the WebMail login endpoint using the PersistentLogin parameter and replay them against the WebAdmin portal, enabling unauthorized administrative actions with high privileges. The vulnerability has a CVSS 4.0 base score of 8.7, indicating a high severity due to network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to bypass authentication and perform highly privileged administrative actions on the MailEnable WebAdmin portal. This could lead to unauthorized access and control over the affected system, compromising confidentiality, integrity, and availability of the mail server environment. No known exploits are reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access to the WebAdmin portal, monitoring for unusual authentication token reuse, and applying compensating controls to limit exposure. Avoid using the PersistentLogin feature if possible. Follow updates from MailEnable for official patches or mitigation instructions.