PT-2026-34055 · Mailcow · Mailcow

Published 2026-04-21 · Updated 2026-04-21 · CVE-2026-40874

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions mailcow: dockerized versions prior to 2026-03b

Description An issue exists where no administrator verification is performed when deleting Forwarding Hosts via the '/api/v1/delete/fwdhost' endpoint. Any authenticated user can call this API, which may lead to significant disruption of the mail service. While checks are applied to edit and add actions, they are missing for deletion.

Recommendations Update to version 2026-03b.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-40874

Affected Products

Mailcow

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-40874 · Security Note
• https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-jjxh-rm7p-hjc3 · Note
• https://twitter.com/VulmonFeeds/status/2046730610169806857 · Twitter Post