Security vulnerabilities

Attached to Project: Security vulnerabilities
Opened by monty099 - 24.06.2026
Last edited by xlefloch - 02.07.2026

Description

Mailman handles email address casing (Uppercase/Lowercase) inconsistently between user creation, account association, and permission assignment.

This issue leads to unauthorized access between users and complete takeover of the resources associated with the targeted account.

Steps to Reproduce

1. Log in to the first Alwaysdata account (Victim).

2. Create one or more domains.

3. Create one or more mailing lists using Mailman.

4. Create a Mailman user with the email address "Test@example.com".

5. Assign this user as an Administrator on all mailing lists.

6. Log in to another Alwaysdata account (Attacker).

7. Create a new Mailman user with the email address "test@example.com".

8. Access the Mailman interface from the attacker's account.

9. Observe that the attacker gains access to the victim's Mailman account and all associated permissions.

10. The attacker can now fully manage the victim's mailing lists, including members, settings, and list moderation.

POC: https://admin.alwaysdata.com/support/94240/

Impact

An attacker can take over another user's Mailman account and obtain all permissions granted to it.

This results in:

- Unauthorized access to the victim's Mailman account.
- Inheritance of all permissions associated with the account.
- Full control over the victim's mailing lists.
- Adding or removing members.
- Modifying mailing list settings.
- Performing all actions available to the legitimate administrator.

This results in a complete takeover of the victim's Mailman account and unauthorized control over its resources.

Suggested Fix

Normalize email addresses before user creation, authentication, or permission assignment by converting all addresses to lowercase.

Additionally, prevent the creation of multiple Mailman users whose email addresses differ only by letter case.