CVE-2006-4954: The updateuser servlet in Neon WebMail for Java before 5.08 does not validate the in_id parameter, which al...

Security readout for executives and security teams

Neon WebMail for Java before 5.08 lets a remote attacker alter other users’ account information. The reported impacts include changing passwords and permissions, viewing profile settings, and creating or deleting users. That can become a business-critical mailbox takeover issue where the product is still exposed. Exposure is likely limited to organizations still running Neon WebMail for Java versions before 5.08, especially if the webmail interface is reachable from untrusted networks. The source bundle does not identify specific platforms, packages, or CPEs. Prioritize remediation if this webmail system is still used or internet-facing. The issue directly affects account control and permissions, but the product and CVE are old and the bundle provides no evidence of active exploitation. Mitigation focus: Upgrade Neon WebMail for Java to 5.08 or later, following vendor guidance.; Restrict access to the webmail application from untrusted networks.; Review user accounts, permissions, and password changes for unauthorized modifications..

Prepared

Jun 29, 2026, 10:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.