Is there a patch available for CVE-2026-40874?

Yes, a patch is available for CVE-2026-40874. Update the affected software to the latest version immediately.

mailcow-dockerized CVE-2026-40874

Q: What is the CVSS score of CVE-2026-40874?

CVE-2026-40874 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

Q: Which versions of mailcow-dockerized are affected by CVE-2026-40874?

Missing authorization on the `/api/v1/delete/fwdhost` endpoint in mailcow-dockerized allows any low-privileged authenticated user to delete Forwarding Hosts, disrupting outbound mail routing and…. A patch is available.

EUVD-2026-24256 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 GitHub_M

Authentication Bypass Docker Mailcow Mailcow Dockerized

6.0

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable API requires only low-privilege authentication; deletion yields pure availability impact with no confidentiality or integrity exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:09 vuln.today

Patch released

Apr 22, 2026 - 21:02 nvd

Patch available

Apr 21, 2026 - 21:02 EUVD

CVSS changed

Apr 21, 2026 - 20:22 NVD

6.0 (MEDIUM)

EUVD ID Assigned

Apr 21, 2026 - 20:00 euvd

EUVD-2026-24256

CVE Published

Apr 21, 2026 - 19:17 nvd

MEDIUM 6.0

DescriptionGitHub Advisory

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administrator verification takes place when deleting Forwarding Hosts with /api/v1/delete/fwdhost. Any authenticated user can call this API. Checks are only applied for edit/add actions, but deletion can still significantly disrupt the mail service. Version 2026-03b fixes the vulnerability.

AnalysisAI

Missing authorization on the /api/v1/delete/fwdhost endpoint in mailcow-dockerized allows any low-privileged authenticated user to delete Forwarding Hosts, disrupting outbound mail routing and overall service availability. All versions prior to 2026-03b are affected; the flaw is rooted in inconsistent access control - add/edit operations are gated to administrators but the delete pathway is not. EPSS is low (0.04%) and the vulnerability is not in CISA KEV, though SSVC data indicates POC code exists, lowering the exploitation barrier for users with valid credentials.

Technical ContextAI

mailcow-dockerized (CPE: cpe:2.3:a:mailcow:mailcow-dockerized) is a Docker-composed open-source groupware and email suite exposing a REST API for administrative operations. The vulnerability is classified as CWE-284 (Improper Access Control): the /api/v1/delete/fwdhost API endpoint performs no privilege verification before executing deletion, despite the functionally equivalent add and edit endpoints enforcing admin-only access. Forwarding Hosts are configuration entries that control mail relay and routing; their unauthorized removal can halt or misdirect mail delivery. The Docker-based deployment model means the API surface is typically reachable across internal networks and, in internet-exposed deployments, externally.

RemediationAI

Upgrade to mailcow-dockerized version 2026-03b or later, which introduces proper administrator-level authorization checks on the /api/v1/delete/fwdhost endpoint. The fix is confirmed by the vendor in GitHub Security Advisory GHSA-jjxh-rm7p-hjc3 (https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-jjxh-rm7p-hjc3). As a compensating control prior to patching, restrict access to the mailcow API at the network or reverse-proxy layer so that only administrator-level sessions or trusted IP ranges can reach DELETE endpoints; note this may break legitimate integrations that rely on API access for non-admin users. Additionally, audit current mailcow user accounts to minimize the number of non-administrative authenticated users until the patch is applied.