SmarterTools SmarterMail Missing Authorization Privilege Escalation Vulnerability

November 13th, 2026
ZDI-26-995 ZDI-CAN-33566

CVE ID

CVE-2026-126966

CVSS Score

8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Vendors

SmarterTools

Affected Products

SmarterMail

Vulnerability Details

This vulnerability allows remote attackers to escalate privileges on affected installations of SmarterTools SmarterMail. Authentication is required to exploit this vulnerability.

The specific flaw exists within the svcDomainAdmin.asmx endpoint. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user.

Additional Details

Fixed in SmarterMail Build 9735


Disclosure Timeline

  • 2026-08-20 - Vulnerability reported to vendor
  • 2026-11-13 - Coordinated public release of advisory
  • 2026-11-13 - Advisory Updated

Credit

Shaber Tseng

Back to Advisories