- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 11
- Public CVEs
- 1
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
11 assets you may test, 6 excluded.
Web 1
- https://mailu.io
Products and areas 10
- Certificate handling and the ACME integration behind it
- Fetchmail, forwarding, aliases and every other rule deciding where a message ends up
- The admin front end in full: authentication, session handling, and every page an administrator, a domain manager or a mailbox user can reach
- The API, including token issuance, token management and every endpoint sitting behind them
- The authentication service the mail daemons call to check a credential, including the header-based proxy authentication path
- The container set and its configuration: the compose definitions, the environment variables holding secrets, and the reverse proxy Mailu ships in front of everything
- The multi-tenant model: domains, aliases, per-domain administrators, and the checks keeping one domain's configuration out of another's reach
- The policy accepts severe security issues at a private address and sets no boundary on which part of Mailu they may be in. Everything Mailu itself writes or wires together is inside that
- The setup utility that generates a deployment's configuration, since a defect there ships into every new installation
- The webmail integration, covering the single sign-on handoff into Roundcube or SnappyMail and the session that lands on the other side
Out of scope (6)
- Defects inside the bundled upstreams themselves. Postfix, Dovecot, rspamd, Roundcube and SnappyMail are separate projects with their own reporting channels
- Findings against release lines the project no longer ships
- Operator configuration, including a deployment exposed without the intended reverse proxy in front of it
- The Docker daemon, the host operating system and whatever orchestration an operator chose
- Upstream Python dependencies, unless Mailu's own use of them is what makes the defect reachable
- Volumetric denial of service against a mail server that accepts mail from strangers by design
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Send it to the address on the policy page , the private address SECURITY.md publishes for severe issues
-
Use that address even when you think the finding is minor. The policy asks for minor issues to be opened as public GitHub issues, and on a mail server that is a disclosure with no embargo and no chance to coordinate
-
You are being asked to rank severity yourself before you know how the code is deployed. Do not. Describe the impact precisely and let the maintainers rank it
-
Establish which component owns the bug. Mailu wires together Postfix, Dovecot, rspamd and a webmail client, and a defect inside one of those belongs to that project
-
Mailu's own code is the admin front end, the API and the container configuration, and both of the past year's findings landed there
-
There is no payment to negotiate: no bounty, no commercial entity and no reward terms
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2020-5239 | In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed ins | High 8.7 | 13 Feb 2020 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 2 Last 12 months Auth bypass 50 % Missing authentication 25 % Access control 15 % Input validation 10 % Latest advisories Loading the feed Overview Mailu is a self-hosted mail stack assembled from containers: Postfix and Dovecot for transport and mailboxes, rspamd for filtering, Roundcube or SnappyMail for webmail, and a Python admin front end holding it together. It is one of the two standard answers for running your own mail server, deployed by small organisations and individuals with no security team behind them. The reference point is GHSA-rfhj-4wcq-74xg from July 2026, rated critical: a spoofable X- header defeated the header-based proxy authentication. Nothing is paid for a report and there is no company behind the project, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy accepts severe security issues at a private address and sets no boundary on which part of Mailu they may be in. Everything Mailu itself writes or wires together is inside that The admin front end in full: authentication, session handling, and every page an administrator, a domain manager or a mailbox user can reach The API, including token issuance, token management and every endpoint sitting behind them The authentication service the mail daemons call to check a credential, including the header-based proxy authentication path The multi-tenant model: domains, aliases, per-domain administrators, and the checks keeping one domain's configuration out of another's reach The webmail integration, covering the single sign-on handoff into Roundcube or SnappyMail and the session that lands on the other side Fetchmail, forwarding, aliases and every other rule deciding where a message ends up The container set and its configuration: the compose definitions, the environment variables holding secrets, and the reverse proxy Mailu ships in front of everything Certificate handling and the ACME integration behind it The setup utility that generates a deployment's configuration, since a defect there ships into every new installation Out of scope Defects inside the bundled upstreams themselves. Postfix, Dovecot, rspamd, Roundcube and SnappyMail are separate projects with their own reporting channels Operator configuration, including a deployment exposed without the intended reverse proxy in front of it The Docker daemon, the host operating system and whatever orchestration an operator chose Upstream Python dependencies, unless Mailu's own use of them is what makes the defect reachable Volumetric denial of service against a mail server that accepts mail from strangers by design Findings against release lines the project no longer ships Most-valued findings Authentication bypass first, because that is exactly what this project has been producing. GHSA-rfhj-4wcq-74xg was rated critical for accepting a spoofable X- header as proof of identity in the proxy-authentication path Any place a trust boundary is inferred from a request header rather than verified. The critical above is the general form of that mistake, and Mailu has several internal hops between containers where it could recur Endpoints missing an authentication or authorization check outright, the class CVE-2026-49217 landed in on the token API Token handling in full: issuance, scope, revocation, and what a stolen or modified token actually reaches Cross-domain access on a multi-tenant deployment, where a domain administrator reaches another domain's mailboxes or configuration The single sign-on handoff into webmail, where a session is minted by one component and trusted by another Anything reaching the credentials the containers use to talk to each other, since those unlock every mailbox on the host Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Send it to [email protected] , the private address SECURITY.md publishes for severe issues Use that address even when you think the finding is minor. The policy asks for minor issues to be opened as public GitHub issues, and on a mail server that is a disclosure with no embargo and no chance to coordinate You are being asked to rank severity yourself before you know how the code is deployed. Do not. Describe the impact precisely and let the maintainers rank it Establish which component owns the bug. Mailu wires together Postfix, Dovecot, rspamd and a webmail client, and a defect inside one of those belongs to that project Mailu's own code is the admin front end, the API and the container configuration, and both of the past year's findings landed there There is no payment to negotiate: no bounty, no commercial entity and no reward terms Disclosure Coordinated by email with the maintainers and published as GitHub Security Advisories against Mailu/Mailu . The critical proxy-authentication bypass from July 2026 was published without a CVE assigned, so track the GHSA identifier rather than waiting for a CVE to appear. No day count is published, and the practical embargo runs to the release carrying the fix. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability