CVE-2026-7460
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A stored cross-site scripting vulnerability was discovered in the administrator Queue Manager of mailcow-dockerized. The Queue Manager fetches mail queue entries from /api/v1/get/mailq/all, copies server-controlled Postfix queue fields into DataTables rows, and renders several of those fields as HTML without adequate output encoding.
Risk Assessment
An attacker can inject a malicious script that executes in the administrator's browser, leading to session theft, configuration modification, or further privilege escalation.
Recommendation
Update mailcow-dockerized to a version later than 2026-03b that includes a fix for this vulnerability.
Other vulnerabilities in mailcow-dockerized
See all- CVE-2026-40875High
mailcow: dockerized before version 2026-03b has an XSS vulnerability in the "Seen successful connections" (login history) view, where the client IP is rendered without HTML escaping. Because the server trusts the X-Real-IP header as the source IP, an attacker can inject HTML/JS. This Self-XSS can be exploited by Login CSRF to force the victim into the attacker's account.
- CVE-2026-40873High
mailcow: dockerized before version 2026-03b has an XSS vulnerability in the Quarantine details modal, where attachment filenames are inserted into HTML without escaping, allowing arbitrary HTML/JS execution. An attacker can deliver an email with a crafted attachment name so that when an admin views the quarantine item, JavaScript executes in their browser, taking over their account.
- CVE-2026-40872Critical
In mailcow: dockerized before 2026-03b, Autodiscover logs in the admin dashboard render the EMailAddress value without HTML escaping. An unauthenticated attacker can submit a crafted Autodiscover request with HTML/JS, which executes when an admin views the logs.
Original NVD description (English source)
mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager. The Queue Manager fetches mail queue entries from /api/v1/get/mailq/all, copies server-controlled Postfix queue fields into DataTables rows, and renders several of those fields as HTML without adequate output encoding. This issue affects mailcow-dockerized: 2026-03b.