Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface. A delegated admin account with zero permissions can bypass access control checks and gain unauthorized access to the SSL Certificates management endpoint (page=sslcerts). This allows the attacker to view, download, upload, and delete SSL certificate files, despite lacking the necessary privileges to access the Security & Filtering section.
References
Configurations
Configuration 1 (hide)
|
History
13 Feb 2026, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
10 Feb 2026, 14:47
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Axigen axigen Mail Server
Axigen |
|
| References | () https://www.axigen.com/knowledgebase/Axigen-WebAdmin-Improper-Access-Control-Vulnerability-CVE-2025-68721-_406.html - Vendor Advisory | |
| References | () https://www.axigen.com/mail-server/download/ - Product | |
| CPE | cpe:2.3:a:axigen:axigen_mail_server:*:*:*:*:*:*:*:* |
09 Feb 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
05 Feb 2026, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-284 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
05 Feb 2026, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-05 16:15
Updated : 2026-02-13 15:15
NVD link : CVE-2025-68721
Mitre link : CVE-2025-68721
CVE.ORG link : CVE-2025-68721
JSON object : View
Products Affected
axigen
- axigen_mail_server
CWE
CWE-284
Improper Access Control