PT-2026-34053 · Mailcow · Mailcow

CVE-2026-40872 · Published 2026-04-21 · Updated 2026-04-22

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions mailcow: dockerized versions prior to 2026-03b

Description The admin dashboard Autodiscover logs fail to perform HTML escaping on the EMailAddress value, which is logged as the user field. An unauthenticated attacker can submit a crafted Autodiscover request containing HTML or JavaScript in the EMailAddress parameter. This payload is stored in Redis and subsequently executed in the browser of an administrator who views the Autodiscover logs. This is a Stored Cross-Site Scripting (XSS) issue, where a malicious script is permanently stored on the target server.

Recommendations Update to version 2026-03b.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-80

Related Identifiers

CVE-2026-40872

GHSA-F9XF-VC72-RCGM

Affected Products

Mailcow

References · 8

• 🔥 https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-f9xf-vc72-rcgm · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40872.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-40872 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40872 · Security Note
• https://twitter.com/VulmonFeeds/status/2046738289277685788 · Twitter Post
• https://twitter.com/autumn_good_35/status/2046945917941768413 · Twitter Post
• https://twitter.com/CCBalert/status/2046936612379001000 · Twitter Post
• https://twitter.com/0dayPublishing/status/2046675476580540838 · Twitter Post