CVE-2026-40872: mailcow: dockerized - Stored XSS in Autodiscover Admin Logs
mailcow: dockerized is affected by a stored cross-site scripting flaw in the Autodiscover logs shown in its admin dashboard, where the EMailAddress value is rendered without HTML escaping. According to the record, the payload can be submitted through an unauthenticated Autodiscover request and runs when an administrator views the logs. The record states that version 2026-03b fixes the issue, and the CNA rates it critical with a CVSS 4.0 score of 9.3.
Overview
The advisory describes a stored cross-site scripting issue in mailcow: dockerized, an open source groupware and email suite based on Docker. The Autodiscover logs shown in the admin dashboard render the EMailAddress value without HTML escaping.
Impact
- According to the record, the injected content is stored in Redis and executed in the browser of an administrator who views the Autodiscover logs.
- The CVSS 4.0 vector in the record lists high impact on confidentiality, integrity and availability of the vulnerable system, with user interaction required.
- The real impact on a given deployment depends on the administrator's session and environment. This is an inference, not a statement from the sources.
Affected products and versions
- Product: mailcow: dockerized.
- Affected: versions prior to 2026-03b, as stated in the description.
- Fixed: version 2026-03b, as stated in the description.
- The structured affected and fixes fields in the record are empty, so version information comes from the description and the GitHub advisory reference.
Exploitation status
The record lists kev.listed as false. No confirmed exploitation appears in the sources consulted. The EPSS value in the record is 0.00444 with a percentile of 0.36798, which is a probability estimate and not evidence of exploitation.
Remediation and mitigation
- Upgrade mailcow: dockerized to version 2026-03b or later, as stated in the record.
- Consult the linked GitHub advisory and the mailcow project documentation for the upgrade procedure.
- Restrict access to the administrative dashboard to trusted networks and staff, which reduces exposure of the logs. This is general defensive practice, not a statement from the sources.
- Until the upgrade is applied, minimize opening Autodiscover logs in the dashboard. This is an inference.
Detection guidance
- Review Autodiscover log entries for unexpected HTML or script-like characters in the user field.
- Correlate Autodiscover activity with web server logs to identify requests from unfamiliar sources.
- Treat any suspicious finding as a potential incident and follow your internal response process.
Limitations of the available information
- The record has no native title, no structured affected or fixed version data, and no CVSS data beyond the CNA score.
- The record's source status is Deferred, and its EPSS date (2026-10-13) should be verified against the original source.
- Whether other mailcow components or versions are affected is unknown from the record.
- Technical exploitation details are intentionally omitted.
Frequently asked questions
What is CVE-2026-40872?
It is a stored cross-site scripting vulnerability in mailcow: dockerized. The Autodiscover logs in the admin dashboard render the EMailAddress value without HTML escaping, according to the record.
Which versions are affected and which version fixes it?
The description states that versions prior to 2026-03b are affected and that version 2026-03b fixes the vulnerability. The structured version fields in the record are empty.
Is this vulnerability known to be exploited?
The record lists kev.listed as false, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.