CVE-2026-13164: MailerUp Auth Bypass Vulnerability

CVE-2026-13164 Overview

CVE-2026-13164 is a Missing Authentication for Critical Function vulnerability [CWE-306] affecting MailerUp versions prior to 1.0.1. The flaw resides in the RegisterView class within apps/accounts/views.py, exposed at the POST /api/auth/register/ endpoint. The endpoint applies Django REST Framework's AllowAny permission class without email verification, CAPTCHA, or administrator approval. A remote, unauthenticated attacker can self-register a working account on instances where registration is intended to be restricted. Any account created through this endpoint can read all stored email data on the instance, leading to full disclosure of stored messages.

Critical Impact
Unauthenticated attackers can self-register accounts and read all stored email data on affected MailerUp instances.

Affected Products

MailerUp versions earlier than 1.0.1
Self-hosted MailerUp instances exposing /api/auth/register/
Deployments relying on network restrictions rather than application-level registration controls

Discovery Timeline

2026-06-24 - CVE-2026-13164 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-13164

Vulnerability Analysis

MailerUp is a Django-based email management application. The RegisterView endpoint at /api/auth/register/ accepts user registration requests through the RegisterSerializer, which validates only email, username, password, and company fields. The view applies the AllowAny permission class from Django REST Framework. This permission explicitly disables authentication and authorization checks for the endpoint.

Once an attacker submits a registration request, the backend calls User.objects.create_user() and immediately provisions a functional account. The newly created account inherits broad read permissions over stored email data managed by the instance. No out-of-band verification, administrator approval, or rate limiting gates the account creation flow.

Root Cause

The root cause is the combination of an open registration endpoint and overly permissive default authorization on email data resources. The application treats any authenticated user as eligible to access stored messages, while simultaneously allowing unauthenticated registration. Self-hosted deployments that assume registration is closed have no application-layer enforcement to back that assumption.

Attack Vector

Exploitation requires only network access to the MailerUp HTTP API. The attacker issues a single POST request to /api/auth/register/ with arbitrary credentials, authenticates with the resulting token, and queries email-related endpoints to exfiltrate stored messages.

python

# Patch from backend/apps/accounts/serializers.py
# Source: https://github.com/Maalfer/mailerup/commit/99eb6d4586134bf3f4422093fbf47d6794ef0ee5

-class RegisterSerializer(serializers.ModelSerializer):
-    password = serializers.CharField(write_only=True, min_length=8)
-
-    class Meta:
-        model = User
-        fields = ("email", "username", "password", "company")
-
-    def create(self, validated_data):
-        password = validated_data.pop("password")
-        return User.objects.create_user(password=password, **validated_data)

python

# Patch from backend/apps/accounts/urls.py removes the public registration route
# Source: https://github.com/Maalfer/mailerup/commit/99eb6d4586134bf3f4422093fbf47d6794ef0ee5

 from django.urls import path
 from .views import (
-    RegisterView, MeView, ChangePasswordView, email_providers, test_email,
+    MeView, ChangePasswordView, email_providers, test_email,
     AdminUserListView, AdminUserDetailView, db_export,
 )

 urlpatterns = [
-    path("register/", RegisterView.as_view()),
+    # No hay registro público: las cuentas las crea solo el admin vía /users/
     path("me/", MeView.as_view()),

The fix removes RegisterView entirely and routes account provisioning through the admin-only AdminUserListView protected by IsAdminUser.

Detection Methods for CVE-2026-13164

Indicators of Compromise

HTTP POST requests to /api/auth/register/ from unexpected source IP addresses or external networks
Newly created user accounts in the MailerUp User table that were not provisioned by an administrator
Authentication tokens issued shortly after registration followed by bulk reads of email listing endpoints
Access log entries showing the same source IP transitioning from registration to authenticated message retrieval

Detection Strategies

Review Django application logs for POST /api/auth/register/ events and correlate them against the authorized account provisioning workflow
Audit the MailerUp User table for accounts whose date_joined falls outside known administrative activity windows
Monitor reverse proxy or WAF logs for repeated registration attempts followed by API calls retrieving stored email content

Monitoring Recommendations

Alert on any successful HTTP 200 or 201 response from /api/auth/register/ until the patched version is deployed
Track outbound traffic volume from MailerUp instances to detect bulk exfiltration of stored messages
Forward Django authentication and access logs to a centralized log platform for retention and correlation with network telemetry

How to Mitigate CVE-2026-13164

Immediate Actions Required

Upgrade MailerUp to version 1.0.1 or later, which removes the public RegisterView and its URL route
Audit all existing user accounts and disable any that were not provisioned by an administrator
Rotate API keys, SMTP credentials, and any secrets that may have been exposed through the leaked email content
Restrict network access to the MailerUp API to trusted operators until the patch is applied

Patch Information

The upstream fix is published in the MailerUp repository under commit 99eb6d4586134bf3f4422093fbf47d6794ef0ee5. The patch removes the RegisterSerializer and RegisterView, deletes the /register/ URL pattern, and documents that accounts must be created by an administrator via the AdminUserListView endpoint protected by IsAdminUser, or through manage.py createsuperuser for initial bootstrap. See the GitHub Commit Log and the CNA CVE-2026-13164 Analysis for full details.

Workarounds

Block the /api/auth/register/ path at the reverse proxy or load balancer if immediate upgrade is not possible
Place the MailerUp instance behind a VPN or IP allowlist so unauthenticated users cannot reach the API
Apply a custom Django middleware that rejects requests to the registration endpoint until the upgrade is complete

bash

# Example nginx rule to block the vulnerable endpoint until patching
location = /api/auth/register/ {
    return 403;
}