CVE-2026-104084SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token
Updated under an hour ago ()
Does this affect you?
It affects Smartertools Smartermail. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.27%, higher than 19% of scored CVEs.
Do this next
Free account, 1 product
SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token issued before an administrator demotion, or a demoted user whose session was not actively polling at the time of demotion, can replay the stale token to obtain a new access token retaining the higher-privilege role (such as DomainAdmin or SysAdmin) until natural token expiry.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-613
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.27% (percentile 19)
- Assigned by
- VulnCheck
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 12, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Smartertools Smartermail smartertools:smartermail (from the name) | before Build 9777 | CNA record |
References
- https://www.smartertools.com/smartermail/release-notes/current#/9526:~:text=Build%209777%20(Oct%208%2C%202026)release-notes, patch
- https://blog.evan.lat/posts/sm/technical-description, exploit
- https://www.vulncheck.com/advisories/smartermail-build-9777-stale-jwt-role-claim-privilege-escalation-via-refresh-tokenthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.