mailcow vulnerabilities

Mailcow version 0.14, used in 'mailcow: dockerized' and other products, has a CSRF vulnerability.

In mailcow versions prior to 2026-03b, the web interface passes the raw $_SERVER['REQUEST_URI'] to Twig as a global template variable and renders it inside a JavaScript string literal in the setLang() helper of base.twig, relying on Twig's default HTML auto-escaping instead of context-appropriate JS escaping. Additionally, the query_string() Twig helper merges all current $_GET parameters into the language-switching links on the login page, so attacker-supplied parameters are reflected and preserved across navigation. Version 2026-03b fixes the vulnerability.

In mailcow versions prior to 2026-03b, no administrator verification occurs when deleting Forwarding Hosts via /api/v1/delete/fwdhost. Any authenticated user can call this API, potentially significantly disrupting the mail service.

A vulnerability has been discovered in mailcow, a mail server suite, that allows an attacker to manipulate internal Dovecot variables by using specially crafted passwords during the authentication process. The issue arises from the behavior of the `passwd-verify.lua` script, which verifies user passwords during login attempts.