Vulnerabilidades do Mailcow Mailcow-dockerized

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Mailcow Mailcow-dockerized: 7 registro(s), com versões afetadas e correções.

CVE-2026-7460 Alta · 7.4 CWE-79 20/05/2026

mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped

mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager. The Queue Manager fetches mail queue entries from /api/v1/get/mailq/all, copies server-controlled Postfix queue fields into DataTables rows, and renders several of those fields as HTML without adequate output encoding. This issue affects mailcow-dockerized: 2026-03b.

CVE-2026-40878 Baixa · 2.1 Exploit público CWE-79 21/04/2026

mailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the mailcow web interface passes the raw `$_SERVER['REQUEST_URI']` to Twig as a global template variable and renders it inside a JavaScript string literal in the `setLang()` helper of `base.twig`, relying on Twig's default HTML auto-escaping instead of the context-appropriate `js` escaping strategy. In addition, the `query_string()` Twig helper merges all current `$_GET` parameters into the language-switching links on the login page, so attacker-supplied parameters are reflected and preserved across navigation. Version 2026-03b fixes the vulnerability.

CVE-2026-40875 Alta · 7.0 CWE-79 21/04/2026

mailcow: dockerized vulnerable to stored XSS in user login history real_rip

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the user dashboard's "Seen successful connections" (login history) renders the client IP from login logs without HTML escaping. Because the server trusts the X-Real-IP header as the source IP for logging, an attacker can inject HTML/JS into this field. This Self-XSS can be exploited by a Login CSRF to force the victim into the attacker's account, and then read emails in a previous browser tab. Version 2026-03b fixes the vulnerability.

CVE-2026-40874 Média · 6.0 CWE-284 21/04/2026

mailcow: dockerized missing authorization on Forwarding Hosts delete action

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administrator verification takes place when deleting Forwarding Hosts with `/api/v1/delete/fwdhost`. Any authenticated user can call this API. Checks are only applied for edit/add actions, but deletion can still significantly disrupt the mail service. Version 2026-03b fixes the vulnerability.

CVE-2026-40873 Alta · 8.9 CWE-79 21/04/2026

mailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenames

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the Quarantine details modal injects attachment filenames into HTML without escaping, allowing arbitrary HTML/JS execution. An attacker can deliver an email with a crafted attachment name so that when an admin views the quarantine item, JavaScript executes in their browser, taking over their account. Version 2026-03b fixes the vulnerability.

CVE-2026-40872 Crítica · 9.3 CWE-79 21/04/2026

mailcow: dockerized - XSS armazenado nos logs do Autodiscover no painel administrativo

mailcow: dockerized é um conjunto de ferramentas de groupware e e-mail de código aberto baseado em Docker. Nas versões anteriores a 2026-03b, os logs do Autodiscover no painel administrativo renderizam o valor EMailAddress (registrado como campo "user") sem escape de HTML. Ao enviar uma requisição Autodiscover não autenticada com um EMailAddress elaborado contendo HTML/JS, o conteúdo é armazenado no Redis e executado quando um administrador visualiza os logs do Autodiscover. A versão 2026-03b corrige a vulnerabilidade.

CVE-2026-40871 Alta · 7.2 CWE-20 21/04/2026

mailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API

mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026-03b have a second-order SQL injection vulnerability in the quarantine_category field via the Mailcow API. The /api/v1/add/mailbox endpoint stores quarantine_category without validation or sanitization. This value is later used by quarantine_notify.py, which constructs SQL queries using unsafe % string formatting instead of parameterized queries. This results in a delayed (second-order) SQL injection when the quarantine notification job executes, allowing an attacker to inject arbitrary SQL. Using a UNION SELECT, sensitive data (e.g., admin credentials) can be exfiltrated and rendered inside quarantine notification emails. Version 2026-03b fixes the vulnerability.