PT-2026-34056 · Mailcow · Mailcow

Published 2026-04-21 · Updated 2026-04-21 · CVE-2026-40875

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions mailcow: dockerized versions prior to 2026-03b

Description The user dashboard's login history, specifically the Seen successful connections section, fails to perform HTML escaping on the client IP rendered from login logs. Since the server relies on the 'X-Real-IP' header to determine the source IP for logging, an attacker can inject HTML or JavaScript into this field. This leads to Self-XSS, which can be combined with Login CSRF to force a victim into an attacker-controlled account and subsequently allow the attacker to read emails from a previously open browser tab.

Recommendations Update to version 2026-03b.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-80

Related Identifiers

CVE-2026-40875

Affected Products

Mailcow

References · 3

• 🔥 https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-jprq-w83q-q62h · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40875 · Security Note
• https://twitter.com/VulmonFeeds/status/2046722931384828350 · Twitter Post