mailcow dockerized EUVD-2026-24254

| CVE-2026-40872 CRITICAL
Cross-site Scripting (XSS) (CWE-79)
2026-04-21 GitHub_M
XSS Redis Docker Mailcow Dockerized
9.3
CVSS 4.0
Share

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

3
Patch available
Apr 21, 2026 - 21:02 EUVD
Analysis Generated
Apr 21, 2026 - 20:50 vuln.today
CVSS changed
Apr 21, 2026 - 20:22 NVD
9.3 (CRITICAL)

DescriptionNVD

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value (logged as the "user" field) without HTML escaping. By submitting an unauthenticated Autodiscover request with a crafted EMailAddress containing HTML/JS, the payload is stored in Redis and executed when an admin views the Autodiscover logs. Version 2026-03b fixes the vulnerability.

AnalysisAI

Stored cross-site scripting in mailcow dockerized versions before 2026-03b enables remote attackers to execute arbitrary JavaScript in admin sessions by injecting malicious code through unauthenticated Autodiscover requests. The payload persists in Redis and triggers when administrators view Autodiscover logs on the admin dashboard. …

Sign in for full analysis, threat intelligence, and remediation guidance.

RemediationAI

Within 24 hours: Inventory all mailcow Dockerized deployments and document current versions via docker inspect or internal asset management; restrict admin dashboard access to trusted networks using firewall/WAF rules. Within 7 days: Disable or restrict unauthenticated Autodiscover requests at the reverse proxy or network perimeter; implement input validation on Autodiscover endpoints if possible through mailcow configuration. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Share

EUVD-2026-24254 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy