CVE-2026-40875
HighSummary
mailcow: dockerized before version 2026-03b has an XSS vulnerability in the "Seen successful connections" (login history) view, where the client IP is rendered without HTML escaping. Because the server trusts the X-Real-IP header as the source IP, an attacker can inject HTML/JS. This Self-XSS can be exploited by Login CSRF to force the victim into the attacker's account.
Risk Assessment
The risk includes account takeover and potential access to sensitive data such as emails, which could lead to privacy breaches.
Recommendation
Upgrade mailcow to version 2026-03b, which contains the fix. Also consider validating the X-Real-IP header and using secure headers.
Other vulnerabilities in mailcow: dockerized
See all- CVE-2026-40873High
mailcow: dockerized before version 2026-03b has an XSS vulnerability in the Quarantine details modal, where attachment filenames are inserted into HTML without escaping, allowing arbitrary HTML/JS execution. An attacker can deliver an email with a crafted attachment name so that when an admin views the quarantine item, JavaScript executes in their browser, taking over their account.
- CVE-2026-40872Critical
In mailcow: dockerized before 2026-03b, Autodiscover logs in the admin dashboard render the EMailAddress value without HTML escaping. An unauthenticated attacker can submit a crafted Autodiscover request with HTML/JS, which executes when an admin views the logs.
- CVE-2026-7460High
A stored cross-site scripting vulnerability was discovered in the administrator Queue Manager of mailcow-dockerized. The Queue Manager fetches mail queue entries from /api/v1/get/mailq/all, copies server-controlled Postfix queue fields into DataTables rows, and renders several of those fields as HTML without adequate output encoding.
Original NVD description (English source)
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the user dashboard's "Seen successful connections" (login history) renders the client IP from login logs without HTML escaping. Because the server trusts the X-Real-IP header as the source IP for logging, an attacker can inject HTML/JS into this field. This Self-XSS can be exploited by a Login CSRF to force the victim into the attacker's account, and then read emails in a previous browser tab. Version 2026-03b fixes the vulnerability.