What’s Vulnerable › Vulnerabilities

CVE-2026-13164: Unauthenticated self-registration in MailerUp allows access to stored email data

• Severity: high (CVSS 8.8 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-24 · updated 2026-10-23
• Weakness: CWE-306

Description

Missing Authentication for Critical Function (CWE-306) in the RegisterView (apps/accounts/views.py), exposed at POST /api/auth/register/, in MailerUp <1.0.1 allows a remote, unauthenticated attacker to self-register a working account on instances where registration is intended to be restricted, because the endpoint applies the AllowAny permission with no email verification, CAPTCHA, or administrator approval. Any account created this way can read all email stored by the instance, resulting in full disclosure of stored messages to an arbitrary unauthenticated attacker

Affected products

• Mailerup: before 1.0.1 — fixed in 1.0.1

How to fix

Upgrade to a fixed version: Mailerup 1.0.1. Check the vendor advisory for mitigations.

References

• https://github.com/Maalfer/mailerup/commit/99eb6d4586134bf3f4422093fbf47d6794ef0ee5
• https://secur0.com/en/cna/cve-list/cve-2026-13164-unauthenticated-self-registration-in-mailerup-allows-access-to-stored-email-data

Get alerted when CVE-2026-13164 or the next vulnerability affects your stack