PT-2026-42099 · Unknown · Mailcow-Dockerized

Oscar Naveda · Published 2026-05-20 · Updated 2026-05-20 · CVE-2026-7460

Positive Technologies (AI Summary)

CVSS v4.0

7.4

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions mailcow-dockerized version 2026-03b

Description A stored cross-site scripting issue exists in the administrator Queue Manager. The Queue Manager retrieves mail queue entries from the endpoint '/api/v1/get/mailq/all' and copies server-controlled Postfix queue fields into DataTables rows. Several of these fields are rendered as HTML without adequate output encoding, allowing for the execution of malicious scripts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-7460

Affected Products

Mailcow-Dockerized

References · 4

• 🔥 https://fluidattacks.com/advisories/mojabi · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7460 · Security Note
• https://github.com/mailcow/mailcow-dockerized · Note
• https://twitter.com/CVEnew/status/2056994209085940192 · Twitter Post