{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "product": "Mail Assure",
          "vendor": "N-able",
          "versions": [
            {
              "lessThanOrEqual": "April 2026",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "cveTags": [
    {
      "sourceIdentifier": "cve@mitre.org",
      "tags": [
        "disputed",
        "exclusively-hosted-service"
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server accepts arbitrary sender domains without enforcing any domain-to-account binding. As a result, an attacker from any tenant can impersonate other tenant domains, producing messages that pass SPF and DMARC validation. NOTE: N-able\u0027s position is that the behavior is intended functionality of its shared SMTP relay architecture and that the service does not represent that it enforces per-tenant sender-domain binding."
    },
    {
      "lang": "es",
      "value": "N-able Mail Assure hasta abril de 2026 contiene una falla de autorizaci\u00f3n a nivel de dise\u00f1o que permite a un usuario SMTP autenticado enviar correo electr\u00f3nico saliente utilizando direcciones MAIL FROM pertenecientes a otros inquilinos. Al conectarse al puerto TCP SMTP y realizar la autenticaci\u00f3n SMTP (SMTP AUTH) con credenciales v\u00e1lidas, el servidor acepta dominios de remitente arbitrarios sin aplicar ninguna vinculaci\u00f3n de dominio a cuenta. Como resultado, un atacante de cualquier inquilino puede suplantar otros dominios de inquilinos, produciendo mensajes que pasan la validaci\u00f3n SPF y DMARC. NOTA: La posici\u00f3n de N-able es que el comportamiento es una funcionalidad intencionada de su arquitectura de retransmisi\u00f3n SMTP compartida y que el servicio no declara que aplique la vinculaci\u00f3n de dominio de remitente por inquilino."
    }
  ],
  "id": "CVE-2025-68624",
  "lastModified": "2026-10-14T19:10:00.297",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "cve@mitre.org",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-68624",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-17T16:14:20.384301Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-14T01:16:27.220",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "https://deepsec.net/speaker.html#PSLOT782"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://gist.github.com/alessandrobertoldi/1ebe0f48aa0119d787ac0ff710057d92"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.n-able.com/products/mail-assure"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://seclists.org/fulldisclosure/2026/Jun/10"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/alessandrobertoldi/research/blob/main/infinity-day-at-scale-deepsec2025.pdf"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        }
      ],
      "source": "cve@mitre.org",
      "type": "Secondary"
    }
  ]
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Mail Assure",
          "vendor": "N-able",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alessandro Bertoldi, Bertoldi Cybersecurity (bcsec.io)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Enrico Bertoldi, Bertoldi Cybersecurity (bcsec.io)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "N-able Mail Assure contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server accepts arbitrary sender domains without enforcing any domain-to-account binding. As a result, an attacker from any tenant can impersonate other tenant domains, producing messages that pass SPF and DMARC validation, including strict p=reject policies. NOTE: the Supplier disputes this, stating that the reported behavior is intended functionality of its shared SMTP relay service. On 5 May 2026 the MITRE TL-Root, acting as adjudicator under the CVE Record Dispute Policy, determined that the issue meets the criteria for CVE assignment and instructed the MITRE CNA-LR to assign and publish CVE-2025-68624 with the DISPUTED tag. This GCVE record was published by GNA 128 (bcsec) on 31 August 2026, while CVE-2025-68624 was still in RESERVED state, to make the vulnerability information publicly available and citable in the meantime. The CVE Record was published on 14 September 2026 with the DISPUTED and exclusively-hosted-service tags. The CVSS 4.0 assessment published in this record uses Attack Requirements: Present (AT:P), applying the Supplier\u0027s own stated precondition that the impersonated domain must be an independently onboarded and DNS-verified customer of the platform. That precondition is trivially satisfied in practice, because platform customers can be enumerated from public DNS records. Privileges Required is Low, since valid credentials for any tenant on the shared relay are sufficient. The integrity impact is rated High on both the vulnerable system and the subsequent system, because the sender identity asserted by the relay can be forged at will and the resulting message passes SPF and DMARC validation at the receiving side. Discovery and verification: the finders are customers of the platform and hold a legitimate tenant, and the issue was identified in the course of using the product. Third-party tenants were identified from public DNS records showing that their mail is routed through the platform. Using the finders\u0027 own authenticated tenant credentials, test messages were submitted with MAIL FROM addresses belonging to those third-party domains and were delivered to a mailbox hosted on an unrelated provider (Microsoft 365), where they passed SPF and DMARC evaluation at the receiving side. Mail Assure is a hosted multi-tenant service without customer-visible version numbering, so no fixed version boundary can be stated. No further verification testing was carried out after 29 April 2026, when the Supplier confirmed in the dispute correspondence that an authenticated user of one tenant can submit mail using a MAIL FROM address belonging to another tenant\u0027s verified domain, and stated that this is intended functionality. The behaviour itself is therefore not in dispute between the parties, only its classification, and on that basis all versions of the service are recorded as affected with no fix known as of the publication date of this record."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "f067779a-4f52-4938-9371-21316297cc51",
        "shortName": "bcsec"
      },
      "references": [
        {
          "name": "Full Disclosure advisory, 15 June 2026",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/10"
        },
        {
          "name": "Public reference advisory, 6 May 2026",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://gist.github.com/alessandrobertoldi/1ebe0f48aa0119d787ac0ff710057d92"
        },
        {
          "name": "DeepSec Vienna 2025 presentation",
          "tags": [
            "media-coverage"
          ],
          "url": "https://deepsec.net/archive/2025.deepsec.net/speaker.html#PSLOT782"
        },
        {
          "name": "bcsec vulnerability disclosure policy",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://bcsec.io/vulnerability-disclosure-policy.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Enforce a domain-to-account binding at message submission: restrict the domains usable in the SMTP MAIL FROM to those associated with the authenticated account, instead of accepting any domain that is active on the shared platform. This is a change that only the Supplier can make."
        }
      ],
      "source": {
        "discovery": "USER"
      },
      "tags": [
        "disputed",
        "exclusively-hosted-service"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-08-26T00:00:00.000Z",
          "value": "Reported to N-able PSIRT (ticket REQ 6678)."
        },
        {
          "lang": "en",
          "time": "2025-11-21T13:00:00.000Z",
          "value": "Research publicly presented at DeepSec Vienna 2025, 21 November 2025 at 14:00 local time, in the talk \"Infinity Day at Scale: Hijacking Registrars, Defeating 2FA and Spoofing 17,000+ Domains Even with DMARC\" by Alessandro Bertoldi (Bertoldi Cybersecurity / Independent Security Researcher)."
        },
        {
          "lang": "en",
          "time": "2025-12-09T00:00:00.000Z",
          "value": "CVE ID request submitted to MITRE (CVE service request 1964945)."
        },
        {
          "lang": "en",
          "time": "2026-01-27T00:00:00.000Z",
          "value": "The CVE Program initiated the CVE Record Dispute Policy procedure and asked the N-able CNA for its rationale for not assigning a CVE ID, under CVE Program Rules 4.1."
        },
        {
          "lang": "en",
          "time": "2026-01-30T00:00:00.000Z",
          "value": "N-able declined to assign a CVE ID, stating that the reported behaviour is intended functionality of its shared SMTP relay service."
        },
        {
          "lang": "en",
          "time": "2026-05-05T00:00:00.000Z",
          "value": "MITRE TL-Root determination: the issue meets the criteria for CVE assignment; the MITRE CNA-LR is instructed to assign and publish CVE-2025-68624 with the DISPUTED tag. The determination states that the CVE Team still needs a publicly available reference URL before publishing the record."
        },
        {
          "lang": "en",
          "time": "2026-05-06T00:00:00.000Z",
          "value": "First public reference provided to the CVE Team (GitHub Gist), the day after the determination."
        },
        {
          "lang": "en",
          "time": "2026-06-15T00:00:00.000Z",
          "value": "Advisory published on the Full Disclosure mailing list, one of the hosting resources named as acceptable in the determination of 5 May 2026."
        },
        {
          "lang": "en",
          "time": "2026-07-07T00:00:00.000Z",
          "value": "CVE service request 1964945 was closed by the CVE Team for lack of a response, with an invitation to submit a notification of CVE publication request together with the reference URL."
        },
        {
          "lang": "en",
          "time": "2026-08-31T00:00:00.000Z",
          "value": "CVE-2025-68624 still in RESERVED state and no CVE Record published; this GCVE record published by GNA 128 (bcsec)."
        },
        {
          "lang": "en",
          "time": "2026-09-14T00:00:00.000Z",
          "value": "CVE-2025-68624 published by the MITRE CNA-LR with the DISPUTED and exclusively-hosted-service tags. The CVE Record carries a CVSS 3.1 base score of 4.3 (Medium); the CVSS 4.0 assessment of 7.0 (High) in this record is unchanged."
        }
      ],
      "title": "Cross-Tenant Authentication Bypass by Spoofing in N-able Mail Assure",
      "workarounds": [
        {
          "lang": "en",
          "value": "No effective mitigation is available to the domain owner. Hardening DMARC does not help: under RFC 7489 a message passes DMARC when at least one of SPF or DKIM passes with identifier alignment, and the shared relay IP ranges remain authorised in the domain owner\u0027s SPF record, so a message submitted from inside the platform still achieves SPF alignment. This was tested by the finders, including DKIM signing performed on the domain owner\u0027s own infrastructure rather than on the platform, and with a DMARC policy set to adkim=s: the domain remained spoofable. The exposure is therefore removed only by the Supplier-side change described in the solution."
        }
      ],
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [
            {
              "destId": "GCVE-0-2025-68624",
              "type": "equal"
            },
            {
              "destId": "CVE-2025-68624",
              "type": "equal"
            }
          ],
          "vulnId": "GCVE-128-2026-0001"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f067779a-4f52-4938-9371-21316297cc51",
    "assignerShortName": "bcsec",
    "cveId": "CVE-2025-68624",
    "datePublished": "2026-08-31T00:00:00.000Z",
    "dateReserved": "2025-12-19T00:00:00.000Z",
    "dateUpdated": "2026-10-05T00:00:00.000Z",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "GCVE-128-2026-0001"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-68624"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-290"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-14T01:16:27Z",
    "severity": "MODERATE"
  },
  "details": "N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server accepts arbitrary sender domains without enforcing any domain-to-account binding. As a result, an attacker from any tenant can impersonate other tenant domains, producing messages that pass SPF and DMARC validation. NOTE: N-able\u0027s position is that the behavior is intended functionality of its shared SMTP relay architecture and that the service does not represent that it enforces per-tenant sender-domain binding.",
  "id": "GHSA-8wch-g3f4-9xpr",
  "modified": "2026-09-17T18:31:32Z",
  "published": "2026-09-14T03:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68624"
    },
    {
      "type": "WEB",
      "url": "https://deepsec.net/speaker.html#PSLOT782"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/alessandrobertoldi/1ebe0f48aa0119d787ac0ff710057d92"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alessandrobertoldi/research/blob/main/infinity-day-at-scale-deepsec2025.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.n-able.com/products/mail-assure"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2026/Jun/10"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}