CVE-2025-68721 | THREATINT

Description

Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface. A delegated admin account with zero permissions can bypass access control checks and gain unauthorized access to the SSL Certificates management endpoint (page=sslcerts). This allows the attacker to view, download, upload, and delete SSL certificate files, despite lacking the necessary privileges to access the Security & Filtering section.

PUBLISHED Reserved 2025-12-24 | Published 2026-02-05 | Updated 2026-02-13 | Assigner mitre

References

github.com/osmancanvural/CVE-2025-68721 exploit

www.axigen.com/mail-server/download/

www.axigen.com/...rol-Vulnerability-CVE-2025-68721-_406.html

cve.org (CVE-2025-68721)

nvd.nist.gov (CVE-2025-68721)

Download JSON