by Kastro
Paper/Archive/CVE-2026-40872

CVE-2026-40872

mailcow mailcow-dockerized — mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field

EPSS 0.4%public exploitCVSS 9.3
critical.is priorityof 100
44
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 29.9.299 × 206.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value (logged as the "user" field) without HTML escaping. By submitting an unauthenticated Autodiscover request with a crafted EMailAddress containing HTML/JS, the payload is stored in Redis and executed when an admin views the Autodiscover logs. Version 2026-03b fixes the vulnerability.

Affected

ProductAffectedFixed inSource
mailcow-dockerized< 2026-03b–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/mailcow/mailcow-dockerized/security/advisories/GHSA-f9xf-vc72-rcgm