high8.1
CVE-2025-68721
Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface.
Impact
Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface. A delegated admin account with zero permissions can bypass access control checks and gain unauthorized access to the SSL Certificates management endpoint (page=sslcerts). This allows the attacker to view, download, upload, and delete SSL certificate files, despite lacking the necessary privileges to access the Security & Filtering section.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Axigen | Axigen Mail Server | from 10.3.0 before 10.5.57 from 10.6.0 before 10.6.26 |