EUVD-2026-95890

SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token...

CVE-2026-104084 SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token

SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token...

CVE-2026-104084

SmarterMail versions prior to Build 9777 are susceptible to a privilege escalation vulnerability due to stale JWT role claims. The root cause is that JWT access and refresh tokens embed a role claim at issuance which is not revalidated against the account's current role during redemption via the ...

PT-2026-108955

Name of the Vulnerable Software and Affected Versions SmarterMail versions prior to build 9777 Description An issue exists where JSON Web Tokens JWT for access and refresh purposes embed a role claim at the time of issuance. This claim is not revalidated against the account's current role when...

CVE-2026-104084: Insufficient Session Expiration

SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token...