CVE-2026-40872
Critical
Description
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value (logged as the "user" field) without HTML escaping. By submitting an unauthenticated Autodiscover request with a crafted EMailAddress containing HTML/JS, the payload is stored in Redis and executed when an admin views the Autodiscover logs. Version 2026-03b fixes the vulnerability.
SeverityCritical
CVSS9.3
Exploit probability30. percentile0.4%
ProductMailcow-dockerized
PublishedApr 21, 2026
First seenApr 21, 2026
Weakness typeCWE-79Cross-site scripting (XSS)CWE-80CWE-80
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mailcow mailcow-dockerized | < 2026-03b | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.