CVE-2026-40872: mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value (logged as the "user" field) without HTML escaping. By submitting an unauthenticated Autodiscover request with a crafted EMailAddress containing HTML/JS, the payload is stored in Redis and executed when an admin views the Autodiscover logs. Version 2026-03b fixes the vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mailcow: dockerizedto a version that resolves this vulnerability.Fixed in 2026-03b
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40872?
CVE-2026-40872 has a medium severity due to its stored XSS vulnerability affecting the Autodiscover logs in the admin dashboard.
How do I fix CVE-2026-40872?
To fix CVE-2026-40872, upgrade to Mailcow: dockerized version 2026-03b or later.
What versions are affected by CVE-2026-40872?
CVE-2026-40872 affects versions of Mailcow: dockerized prior to 2026-03b.
What type of vulnerability is CVE-2026-40872?
CVE-2026-40872 is classified as a stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-40872?
Users and administrators of Mailcow: dockerized are affected by CVE-2026-40872 due to vulnerable Autodiscover log functionality.