Postorius CVE-2026-44742

Upgrade Postorius to version 1.3.14 or later, which incorporates the fix from GitLab commit c4706abd05ba6bcf472fc674b160d3a9d6a4868b (https://gitlab.com/mailman/postorius/-/commit/c4706abd05ba6bcf472fc674b160d3a9d6a4868b). Organizations unable to immediately upgrade should implement emergency compensating controls: restrict access to the Postorius web interface to trusted administrative networks only via firewall rules or reverse proxy ACLs, reducing attacker surface from AV:N to internal-only access (note: this does not prevent attacks from compromised internal hosts or malicious insiders). Review web application firewall (WAF) rules to detect and block common XSS payloads in HTTP POST/GET parameters, though this may cause false positives with legitimate email content. As a Django application, consider enabling Django's built-in Content Security Policy middleware to restrict script execution, though this requires testing to avoid breaking legitimate Postorius functionality. Review held message queues for suspicious subjects containing HTML/JavaScript tags and purge before moderator review. Do NOT rely solely on browser XSS filters as these are deprecated in modern browsers. Consult the oss-security mailing list thread (https://www.openwall.com/lists/oss-security/2026/05/07/3) for community-identified indicators of compromise and attack patterns from the May 2026 exploitation campaign.